@sofa-buffers/corelib 0.10.0 → 0.11.0

package/dist/index.global.js

@@ -1,7 +1,6 @@
 var SofaBuffers = (function (exports) {
   'use strict';
 
-  var _documentCurrentScript = typeof document !== 'undefined' ? document.currentScript : null;
   var __defProp = Object.defineProperty;
   var __export = (target, all) => {
     for (var name in all)
@@ -14,26 +13,35 @@ var SofaBuffers = (function (exports) {
     API_VERSION: () => API_VERSION,
     ARRAY_MAX: () => ARRAY_MAX,
     ArrayKind: () => ArrayKind,
-    Cursor: () => Cursor,
+    BlobSeq: () => BlobSeq,
     DecodeStatus: () => DecodeStatus,
+    ElementSeq: () => ElementSeq,
     FIXLEN_MAX: () => FIXLEN_MAX,
     FixlenSubtype: () => FixlenSubtype,
+    FramedSeq: () => FramedSeq,
     I64_MAX: () => I64_MAX,
     I64_MIN: () => I64_MIN,
     ID_MAX: () => ID_MAX,
     IStream: () => IStream,
     Long: () => Long,
     MAX_DEPTH: () => MAX_DEPTH,
+    MIN_OUTPUT_BUFFER: () => MIN_OUTPUT_BUFFER,
     OStream: () => OStream,
+    PayloadAcc: () => PayloadAcc,
     SofabError: () => SofabError,
     SofabErrorCode: () => SofabErrorCode,
+    StringSeq: () => StringSeq,
     U64_MAX: () => U64_MAX,
+    UNBOUNDED: () => UNBOUNDED,
     WireType: () => WireType,
     decode: () => decode,
+    decodeUtf8: () => decodeUtf8,
+    elementsEqual: () => elementsEqual,
+    fp32RawBytes: () => fp32RawBytes,
     getKernel: () => getKernel,
+    growingOStream: () => growingOStream,
     jsKernel: () => jsKernel,
-    loadNativeKernel: () => loadNativeKernel,
-    loadWasmKernel: () => loadWasmKernel,
+    longElementsEqual: () => longElementsEqual,
     setKernel: () => setKernel
   });
 
@@ -84,6 +92,9 @@ var SofaBuffers = (function (exports) {
   var I64_MIN = -0x8000000000000000n;
   var I64_MAX = 0x7fffffffffffffffn;
   var VARINT_MAX_BYTES = 10;
+  var MIN_OUTPUT_BUFFER = 1;
+  var FP32_HANDLE_MIN = 64;
+  var FP64_HANDLE_MIN = 16;
   var MAX_DEPTH = 255;
   var DecodeStatus = {
     /** The bytes ended exactly at a field boundary — a valid message. */
@@ -112,7 +123,8 @@ var SofaBuffers = (function (exports) {
     /**
      * A receiver-configured decode limit was exceeded — a dynamic array, string or
      * blob on the wire claims more elements / bytes than the caller's
-     * {@link DecodeLimits} (`maxArrayCount` / `maxStringLen` / `maxBlobLen`)
+     * receiver cap (`max_dyn_array_count` / `max_dyn_string_len` /
+     * `max_dyn_blob_len`, §6.2.1 — stated by generated code, never by this codec)
      * allows. Deliberately distinct from {@link SofabErrorCode.InvalidMsg}:
      * exceeding a limit is *policy*, not wire malformation — the identical bytes
      * decode fine under a looser limit — so differential fuzzing must not read it
@@ -145,6 +157,34 @@ var SofaBuffers = (function (exports) {
     return new SofabError(SofabErrorCode.LimitExceeded, message);
   }
 
+  // src/varint/bits64.ts
+  var SCRATCH = new ArrayBuffer(8);
+  var S_U64 = new BigUint64Array(SCRATCH);
+  var S_I64 = new BigInt64Array(SCRATCH);
+  var S_U32 = new Uint32Array(SCRATCH);
+  S_U64[0] = 0n;
+  S_U32[0] = 1;
+  var LO = S_U64[0] === 1n ? 0 : 1;
+  var HI = LO ^ 1;
+  function splitU64(value) {
+    S_U64[0] = value;
+    return S_U64[0] === value;
+  }
+  function splitI64(value) {
+    S_I64[0] = value;
+    return S_I64[0] === value;
+  }
+  function joinU64(lo, hi) {
+    S_U32[LO] = lo;
+    S_U32[HI] = hi;
+    return S_U64[0];
+  }
+  function joinI64(lo, hi) {
+    S_U32[LO] = lo;
+    S_U32[HI] = hi;
+    return S_I64[0];
+  }
+
   // src/long.ts
   var _Long = class _Long {
     constructor(low, high) {
@@ -155,9 +195,14 @@ var SofaBuffers = (function (exports) {
     static fromBits(low, high) {
       return new _Long(low, high);
     }
-    /** Split a `bigint` into its low/high 32-bit halves (two's complement). */
+    /**
+     * Split a `bigint` into its low/high 32-bit halves (two's complement). The
+     * `BigInt64Array` store *is* `ToBigInt64` — reduction modulo 2^64 — so an
+     * out-of-range value keeps exactly the halves the masks kept (bits64).
+     */
     static fromBigInt(value) {
-      return new _Long(Number(value & 0xffffffffn) >>> 0, Number(value >> 32n & 0xffffffffn) >>> 0);
+      S_I64[0] = value;
+      return new _Long(S_U32[LO], S_U32[HI]);
     }
     /** From an integer `number` (`|n| < 2^53`); sign handled via `bigint` once. */
     static fromNumber(n) {
@@ -170,9 +215,7 @@ var SofaBuffers = (function (exports) {
     }
     /** Materialise as a `bigint`. `signed` reads the high bit as two's complement. */
     toBigInt(signed = false) {
-      let r = BigInt(this.high >>> 0) << 32n | BigInt(this.low >>> 0);
-      if (signed && (this.high & 2147483648) !== 0) r -= 0x10000000000000000n;
-      return r;
+      return signed ? joinI64(this.low, this.high) : joinU64(this.low, this.high);
     }
     /** Decimal string (`signed` interprets the high bit as two's complement). */
     toString(signed = false) {
@@ -190,50 +233,40 @@ var SofaBuffers = (function (exports) {
   var Long = _Long;
 
   // src/varint/leb128.ts
-  function varintSize(value) {
-    let lo = Number(value & 0xffffffffn) >>> 0;
-    let hi = Number(value >> 32n & 0xffffffffn) >>> 0;
-    let n = 0;
-    while (hi !== 0) {
-      n++;
-      const next = (lo >>> 7 | hi << 25) >>> 0;
-      hi >>>= 7;
-      lo = next;
+  function varintSizeLoHi(lo, hi) {
+    if (hi === 0) {
+      return lo < 128 ? 1 : lo < 16384 ? 2 : lo < 2097152 ? 3 : lo < 268435456 ? 4 : 5;
     }
-    while (lo > 127) {
-      n++;
-      lo >>>= 7;
-    }
-    return n + 1;
-  }
-  function encodeVarint(value, out, pos) {
-    let lo = Number(value & 0xffffffffn) >>> 0;
-    let hi = Number(value >> 32n & 0xffffffffn) >>> 0;
-    while (hi !== 0) {
-      out[pos++] = lo & 127 | 128;
-      lo = (lo >>> 7 | hi << 25) >>> 0;
-      hi >>>= 7;
-    }
-    while (lo > 127) {
-      out[pos++] = lo & 127 | 128;
-      lo >>>= 7;
-    }
-    out[pos++] = lo;
-    return pos;
+    const h = hi >>> 3;
+    return h === 0 ? 5 : 5 + (h < 128 ? 1 : h < 16384 ? 2 : h < 2097152 ? 3 : h < 268435456 ? 4 : 5);
   }
   function encodeVarintLoHi(lo, hi, out, pos) {
     lo >>>= 0;
     hi >>>= 0;
-    while (hi !== 0) {
-      out[pos++] = lo & 127 | 128;
-      lo = (lo >>> 7 | hi << 25) >>> 0;
-      hi >>>= 7;
+    if (hi === 0) {
+      while (lo > 127) {
+        out[pos++] = lo & 127 | 128;
+        lo >>>= 7;
+      }
+      out[pos++] = lo;
+      return pos;
+    }
+    out[pos++] = lo & 127 | 128;
+    out[pos++] = lo >>> 7 & 127 | 128;
+    out[pos++] = lo >>> 14 & 127 | 128;
+    out[pos++] = lo >>> 21 & 127 | 128;
+    const b4 = lo >>> 28 | (hi & 7) << 4;
+    let h = hi >>> 3;
+    if (h === 0) {
+      out[pos++] = b4;
+      return pos;
     }
-    while (lo > 127) {
-      out[pos++] = lo & 127 | 128;
-      lo >>>= 7;
+    out[pos++] = b4 | 128;
+    while (h > 127) {
+      out[pos++] = h & 127 | 128;
+      h >>>= 7;
     }
-    out[pos++] = lo;
+    out[pos++] = h;
     return pos;
   }
   function varintSizeNum(value) {
@@ -263,51 +296,78 @@ var SofaBuffers = (function (exports) {
   }
 
   // src/varint/num64.ts
-  var SCRATCH = new DataView(new ArrayBuffer(8));
+  var SCRATCH_BUF = new ArrayBuffer(8);
+  var SCRATCH2 = new DataView(SCRATCH_BUF);
+  var SCRATCH_BYTES = new Uint8Array(SCRATCH_BUF);
+  var SCRATCH_U32 = new Uint32Array(SCRATCH_BUF);
+  var SCRATCH_F32 = new Float32Array(SCRATCH_BUF, 0, 1);
+  var SCRATCH_F64 = new Float64Array(SCRATCH_BUF);
   function toBigInt(value) {
     if (typeof value === "bigint") return value;
     if (!Number.isInteger(value)) {
-      throw new RangeError(`expected an integer, got ${value}`);
+      throw argumentError(`expected an integer, got ${value}`);
     }
     return BigInt(value);
   }
-  function inU64(value) {
-    return value >= 0n && value <= U64_MAX;
-  }
-  function inI64(value) {
-    return value >= I64_MIN && value <= I64_MAX;
-  }
   function packFp32(out, pos, value) {
-    SCRATCH.setFloat32(0, value, true);
-    out[pos] = SCRATCH.getUint8(0);
-    out[pos + 1] = SCRATCH.getUint8(1);
-    out[pos + 2] = SCRATCH.getUint8(2);
-    out[pos + 3] = SCRATCH.getUint8(3);
+    SCRATCH2.setFloat32(0, value, true);
+    out[pos] = SCRATCH_BYTES[0];
+    out[pos + 1] = SCRATCH_BYTES[1];
+    out[pos + 2] = SCRATCH_BYTES[2];
+    out[pos + 3] = SCRATCH_BYTES[3];
     return pos + 4;
   }
   function packFp64(out, pos, value) {
-    SCRATCH.setFloat64(0, value, true);
-    for (let i = 0; i < 8; i++) out[pos + i] = SCRATCH.getUint8(i);
+    SCRATCH2.setFloat64(0, value, true);
+    out[pos] = SCRATCH_BYTES[0];
+    out[pos + 1] = SCRATCH_BYTES[1];
+    out[pos + 2] = SCRATCH_BYTES[2];
+    out[pos + 3] = SCRATCH_BYTES[3];
+    out[pos + 4] = SCRATCH_BYTES[4];
+    out[pos + 5] = SCRATCH_BYTES[5];
+    out[pos + 6] = SCRATCH_BYTES[6];
+    out[pos + 7] = SCRATCH_BYTES[7];
     return pos + 8;
   }
-  function unpackFp32(buf, pos) {
-    SCRATCH.setUint8(0, buf[pos]);
-    SCRATCH.setUint8(1, buf[pos + 1]);
-    SCRATCH.setUint8(2, buf[pos + 2]);
-    SCRATCH.setUint8(3, buf[pos + 3]);
-    return SCRATCH.getFloat32(0, true);
+  function fp32Bits(value) {
+    SCRATCH2.setFloat32(0, value, true);
+    return SCRATCH2.getUint32(0, true);
+  }
+  function fp64BitsLo(value) {
+    SCRATCH2.setFloat64(0, value, true);
+    return SCRATCH2.getUint32(0, true);
+  }
+  function fp64BitsHi(value) {
+    SCRATCH2.setFloat64(0, value, true);
+    return SCRATCH2.getUint32(4, true);
   }
-  function unpackFp64(buf, pos) {
-    for (let i = 0; i < 8; i++) SCRATCH.setUint8(i, buf[pos + i]);
-    return SCRATCH.getFloat64(0, true);
+  function fp32FromBits(bits) {
+    SCRATCH_U32[0] = bits;
+    return SCRATCH_F32[0];
+  }
+  function fp32RawBytes(bits) {
+    const out = new Uint8Array(4);
+    out[0] = bits & 255;
+    out[1] = bits >>> 8 & 255;
+    out[2] = bits >>> 16 & 255;
+    out[3] = bits >>> 24 & 255;
+    return out;
+  }
+  function fp64FromBits(lo, hi) {
+    SCRATCH_U32[LO] = lo;
+    SCRATCH_U32[HI] = hi;
+    return SCRATCH_F64[0];
   }
 
   // src/varint/zigzag.ts
-  function zigzagEncode(value) {
-    return (value << 1n ^ value >> 63n) & U64_MAX;
-  }
-  function zigzagDecode(value) {
-    return value >> 1n ^ -(value & 1n);
+  function encodeZigzagVarintLoHi(lo, hi, out, pos) {
+    const sgn = -(hi >>> 31) >>> 0;
+    return encodeVarintLoHi(
+      (lo << 1 >>> 0 ^ sgn) >>> 0,
+      ((hi << 1 | lo >>> 31) >>> 0 ^ sgn) >>> 0,
+      out,
+      pos
+    );
   }
 
   // src/backend/js.ts
@@ -315,36 +375,161 @@ var SofaBuffers = (function (exports) {
   var jsKernel = {
     name: "js",
     encodeUnsignedVarints(values, out, pos) {
-      for (let i = 0; i < values.length; i++) {
+      const n = values.length;
+      const ctor = values.constructor;
+      if (ctor === BigUint64Array) {
+        const a = values;
+        const h = new Uint32Array(a.buffer, a.byteOffset, a.length * 2);
+        for (let i = 0; i < n; i++) {
+          pos = encodeVarintLoHi(h[i * 2 + LO], h[i * 2 + HI], out, pos);
+        }
+        return pos;
+      }
+      if (ctor === Uint8Array || ctor === Uint16Array || ctor === Uint32Array) {
+        const a = values;
+        for (let i = 0; i < n; i++) {
+          let v = a[i];
+          while (v > 127) {
+            out[pos++] = v & 127 | 128;
+            v >>>= 7;
+          }
+          out[pos++] = v;
+        }
+        return pos;
+      }
+      for (let i = 0; i < n; i++) {
         const v = values[i];
         if (typeof v === "number" && v >= 0 && v <= Number.MAX_SAFE_INTEGER && Number.isInteger(v)) {
           pos = encodeVarintNum(v, out, pos);
-        } else {
-          pos = encodeVarint(toBigInt(v), out, pos);
+          continue;
+        }
+        const b = toBigInt(v);
+        if (!splitU64(b)) throw argumentError(`unsigned value ${b} out of range`);
+        let lo = S_U32[LO];
+        const hi = S_U32[HI];
+        if (hi === 0) {
+          while (lo > 127) {
+            out[pos++] = lo & 127 | 128;
+            lo >>>= 7;
+          }
+          out[pos++] = lo;
+          continue;
         }
+        out[pos++] = lo & 127 | 128;
+        out[pos++] = lo >>> 7 & 127 | 128;
+        out[pos++] = lo >>> 14 & 127 | 128;
+        out[pos++] = lo >>> 21 & 127 | 128;
+        const b4 = lo >>> 28 | (hi & 7) << 4;
+        let h = hi >>> 3;
+        if (h === 0) {
+          out[pos++] = b4;
+          continue;
+        }
+        out[pos++] = b4 | 128;
+        while (h > 127) {
+          out[pos++] = h & 127 | 128;
+          h >>>= 7;
+        }
+        out[pos++] = h;
       }
       return pos;
     },
     encodeSignedVarints(values, out, pos) {
+      const ctorS = values.constructor;
+      if (ctorS === BigInt64Array) {
+        const a = values;
+        const h = new Uint32Array(a.buffer, a.byteOffset, a.length * 2);
+        for (let i = 0; i < a.length; i++) {
+          pos = encodeZigzagVarintLoHi(h[i * 2 + LO], h[i * 2 + HI], out, pos);
+        }
+        return pos;
+      }
+      if (ctorS === Int8Array || ctorS === Int16Array || ctorS === Int32Array) {
+        const a = values;
+        const n = a.length;
+        for (let i = 0; i < n; i++) {
+          const x = a[i];
+          let z = (x << 1 ^ x >> 31) >>> 0;
+          while (z > 127) {
+            out[pos++] = z & 127 | 128;
+            z >>>= 7;
+          }
+          out[pos++] = z;
+        }
+        return pos;
+      }
       for (let i = 0; i < values.length; i++) {
         const v = values[i];
         if (typeof v === "number" && v >= -SIGNED_FAST_MAX && v <= SIGNED_FAST_MAX && Number.isInteger(v)) {
           pos = encodeVarintNum(v >= 0 ? v * 2 : -v * 2 - 1, out, pos);
         } else {
-          pos = encodeVarint(zigzagEncode(toBigInt(v)), out, pos);
+          const b = toBigInt(v);
+          if (!splitI64(b)) throw argumentError(`signed value ${b} out of range`);
+          pos = encodeZigzagVarintLoHi(S_U32[LO], S_U32[HI], out, pos);
         }
       }
       return pos;
     },
+    // Both float packers take one `DataView` over the destination *once the run is
+    // long enough to pay for it* — the language-forced handle of CORELIB_PLAN §6.6.2,
+    // and the only way to place an IEEE-754 value at a byte offset. It carries no
+    // message bytes (the storage is the caller's) and no wire number sizes it.
+    //
+    // The threshold is arithmetic, not taste. Measured on Node 24:
+    // `new DataView(buf.buffer, off, len)` costs **129 ns**, while the handle saves
+    // 1.9 ns per `fp32` (4.11 -> 2.23) and 7.3 ns per `fp64` (10.48 -> 3.20). So it
+    // breaks even at ~68 `fp32` and ~18 `fp64` elements; below that the scratch route
+    // wins, and a two-element array through a handle is a pessimisation.
     packFp32Array(values, out, pos) {
-      for (let i = 0; i < values.length; i++) {
-        pos = packFp32(out, pos, values[i]);
+      const n = values.length;
+      if (values instanceof Float32Array) {
+        if (n < FP32_HANDLE_MIN) {
+          let w2 = null;
+          for (let i = 0; i < n; i++) {
+            const v = values[i];
+            if (v === v) {
+              pos = packFp32(out, pos, v);
+              continue;
+            }
+            if (w2 === null) w2 = new Uint32Array(values.buffer, values.byteOffset, n);
+            const x = w2[i];
+            out[pos] = x;
+            out[pos + 1] = x >>> 8;
+            out[pos + 2] = x >>> 16;
+            out[pos + 3] = x >>> 24;
+            pos += 4;
+          }
+          return pos;
+        }
+        const w = new Uint32Array(values.buffer, values.byteOffset, n);
+        const dv2 = new DataView(out.buffer, out.byteOffset, out.byteLength);
+        for (let i = 0; i < n; i++) {
+          dv2.setUint32(pos, w[i], true);
+          pos += 4;
+        }
+        return pos;
+      }
+      if (n < FP32_HANDLE_MIN) {
+        for (let i = 0; i < n; i++) pos = packFp32(out, pos, values[i]);
+        return pos;
+      }
+      const dv = new DataView(out.buffer, out.byteOffset, out.byteLength);
+      for (let i = 0; i < n; i++) {
+        dv.setFloat32(pos, values[i], true);
+        pos += 4;
       }
       return pos;
     },
     packFp64Array(values, out, pos) {
-      for (let i = 0; i < values.length; i++) {
-        pos = packFp64(out, pos, values[i]);
+      const n = values.length;
+      if (n < FP64_HANDLE_MIN) {
+        for (let i = 0; i < n; i++) pos = packFp64(out, pos, values[i]);
+        return pos;
+      }
+      const dv = new DataView(out.buffer, out.byteOffset, out.byteLength);
+      for (let i = 0; i < n; i++) {
+        dv.setFloat64(pos, values[i], true);
+        pos += 8;
       }
       return pos;
     }
@@ -374,19 +559,18 @@ var SofaBuffers = (function (exports) {
   }
 
   // src/encode/fixlen.ts
-  var UTF8 = new TextEncoder();
   function unpairedSurrogate(index) {
     return argumentError(
       `unpaired surrogate at index ${index}: string value is not valid UTF-8`
     );
   }
-  function encodeUtf8(text) {
-    utf8Length(text);
-    return UTF8.encode(text);
-  }
   function utf8Length(text) {
-    let len = 0;
-    for (let i = 0; i < text.length; i++) {
+    const n = text.length;
+    let a = 0;
+    while (a < n && text.charCodeAt(a) < 128) a++;
+    if (a === n) return n;
+    let len = a;
+    for (let i = a; i < n; i++) {
       const c = text.charCodeAt(i);
       if (c < 128) {
         len += 1;
@@ -409,7 +593,17 @@ var SofaBuffers = (function (exports) {
     return len;
   }
   function utf8Write(text, out, pos) {
-    for (let i = 0; i < text.length; i++) {
+    const n = text.length;
+    let a = 0;
+    while (a < n) {
+      const c = text.charCodeAt(a);
+      if (c >= 128) break;
+      out[pos + a] = c;
+      a++;
+    }
+    pos += a;
+    if (a === n) return pos;
+    for (let i = a; i < n; i++) {
       let c = text.charCodeAt(i);
       if (c < 128) {
         out[pos++] = c;
@@ -438,68 +632,139 @@ var SofaBuffers = (function (exports) {
     }
     return pos;
   }
+  function utf8WriteSink(text, sink) {
+    const n = text.length;
+    for (let i = 0; i < n; i++) {
+      let c = text.charCodeAt(i);
+      if (c < 128) {
+        sink.putByte(c);
+      } else if (c < 2048) {
+        sink.putByte(192 | c >> 6);
+        sink.putByte(128 | c & 63);
+      } else if (c >= 55296 && c <= 56319) {
+        const c2 = i + 1 < n ? text.charCodeAt(i + 1) : 0;
+        if (c2 >= 56320 && c2 <= 57343) {
+          i++;
+          c = 65536 + (c - 55296 << 10) + (c2 - 56320);
+          sink.putByte(240 | c >> 18);
+          sink.putByte(128 | c >> 12 & 63);
+          sink.putByte(128 | c >> 6 & 63);
+          sink.putByte(128 | c & 63);
+        } else {
+          throw unpairedSurrogate(i);
+        }
+      } else if (c >= 56320 && c <= 57343) {
+        throw unpairedSurrogate(i);
+      } else {
+        sink.putByte(224 | c >> 12);
+        sink.putByte(128 | c >> 6 & 63);
+        sink.putByte(128 | c & 63);
+      }
+    }
+  }
 
   // src/encode/ostream.ts
-  var DEFAULT_CAPACITY = 256;
   var SIGNED_FAST_MAX2 = 4503599627370496;
+  function checkHandover(buffer, offset, streaming, carried) {
+    if (offset < 0 || offset > buffer.length) {
+      throw argumentError(`offset ${offset} out of range`);
+    }
+    if (!Number.isInteger(carried) || carried < 0 || carried > offset) {
+      throw argumentError(`carried ${carried} out of range 0..${offset}`);
+    }
+    if (streaming && buffer.length - offset < MIN_OUTPUT_BUFFER) {
+      throw argumentError(
+        `output buffer with a flush sink has ${buffer.length - offset} usable byte(s), below MIN_OUTPUT_BUFFER (${MIN_OUTPUT_BUFFER})`
+      );
+    }
+  }
   var OStream = class {
+    /**
+     * Encoder over a caller buffer, optionally draining to `flush` as it fills.
+     *
+     * Those are the only two buffer models there are (CORELIB_PLAN §5.1.1): the
+     * buffer the caller hands over, and whatever a sink installs in its place
+     * (§5.1.5). There is no third parameter through which the encoder could be
+     * given something to enlarge — growing a destination from a write path is what
+     * §6.6's second violation row names, whoever owns the allocator.
+     *
+     * Constructing one is the only allocating step (§6.6): it sizes the hold-back
+     * run from `MAX_DEPTH` and reads the active kernel once. No `write*` call after
+     * that allocates anything.
+     */
     constructor(buffer, offset = 0, flush) {
       this.depth = 0;
-      /**
-       * Ids of the innermost open sequences whose header has not been written yet
-       * (MESSAGE_SPEC §2 lazy framing, {@link OStream.writeSequenceBeginLazy}).
-       * Always a contiguous suffix of the open sequences: writing any field commits
-       * the whole run at once, so {@link OStream.writeSequenceEnd} can drop the
-       * innermost one by dropping the last entry. Held-back ids are encoder state,
-       * never buffer content, so a flush can never split a run.
-       *
-       * Storage plus an explicit count rather than `push`/`pop`, so the slots are
-       * reused across messages (no allocation on a pooled encoder) and so
-       * {@link OStream.commitPending} can zero the count *before* it writes.
-       *
-       * The array grows on demand and is bounded only by `MAX_DEPTH` — there is no
-       * fixed hold-back window and hence no eager-framing fallback, which is what
-       * CORELIB_PLAN §6 ("How deep the hold-back reaches") demands of an
-       * implementation that can allocate: canonical output at *every* depth.
-       */
-      this.pending = [];
       /** Valid entries in {@link OStream.pending}. */
       this.nPending = 0;
+      /**
+       * How many buffer installations {@link OStream.setBuffer} has made. Only ever
+       * compared for equality across the flush callback, which is how
+       * {@link OStream.flush} tells "the sink copied and returned" from "the sink
+       * took the buffer and installed a replacement" — the one distinction §5.1
+       * rests the handover contract on, and the one that decides whether the start
+       * offset was consumed or re-armed.
+       */
+      this.installs = 0;
       this.kernel = getKernel();
-      if (buffer === void 0) {
-        this.buf = new Uint8Array(DEFAULT_CAPACITY);
-        this.start = 0;
-        this.pos = 0;
-        this.flushSink = void 0;
-        this.canGrow = true;
-      } else {
-        if (offset < 0 || offset > buffer.length) {
-          throw argumentError(`offset ${offset} out of range`);
-        }
-        this.buf = buffer;
-        this.start = offset;
-        this.pos = offset;
-        this.flushSink = flush;
-        this.canGrow = false;
-      }
+      this.pending = new Array(MAX_DEPTH);
+      checkHandover(buffer, offset, flush !== void 0, 0);
+      this.buf = buffer;
+      this.start = offset;
+      this.origin = offset;
+      this.pos = offset;
+      this.flushSink = flush;
     }
-    /** Bytes currently held in the buffer (since construction or the last flush). */
+    /** Bytes of the message currently held in the buffer (see {@link bytes}). */
     get bytesUsed() {
-      return this.pos - this.start;
+      return this.pos - this.origin;
     }
     /**
-     * The encoded message so far, as a view into the working buffer.
-     * Meaningful for the in-memory mode; in streaming mode it is only the
-     * not-yet-flushed tail. The view is valid until the next write.
+     * The encoded message so far, as a view into the working buffer: everything
+     * written since construction, the last {@link reset}, or the last flush the
+     * sink returned from without installing a buffer. With a flush sink that is
+     * normally only the not-yet-flushed tail; on a stream whose sink hands back a
+     * replacement carrying the earlier bytes — the accumulator `growingOStream`
+     * builds — it is the whole message. The view is valid until the next write.
      */
     bytes() {
-      return this.buf.subarray(this.start, this.pos);
+      return this.buf.subarray(this.origin, this.pos);
     }
-    /** Drain buffered bytes to the flush sink (no-op without one). */
+    /**
+     * Drain buffered bytes to the flush sink (no-op without one).
+     *
+     * A sink that returns **without** installing a buffer has copied what it was
+     * handed, so the encoder keeps writing into the same buffer — resuming at
+     * offset **0**. The start offset belongs to the *installation*, not to the
+     * buffer (CORELIB_PLAN §5.1): the buffer-set that armed it — the constructor
+     * or {@link OStream.setBuffer} — reserved room in the unit it began, and
+     * handing that unit over consumes the reservation. A sink that wants header
+     * room in *every* unit re-arms it by calling `setBuffer(buf, offset)` from
+     * inside the callback, a new installation like any other; a bare return must
+     * not do it implicitly, or the leading bytes would be capacity the rest of the
+     * stream could never use and the two shapes would be indistinguishable.
+     */
     flush() {
+      this.drain(0);
+    }
+    /**
+     * {@link flush}, plus the number of contiguous bytes the caller wants at the
+     * cursor afterwards — `0` when it wants none in particular.
+     *
+     * Split out from the public `flush` so the figure cannot be invented by a
+     * caller: it is the encoder's own reserve request, and a sink that sizes a
+     * replacement from it (`growingOStream`) has to be able to trust it. Everything
+     * else is identical, including that a sink which returns without installing has
+     * *copied* and the cursor resumes at `0`.
+     */
+    drain(needed) {
       if (this.flushSink && this.pos > this.start) {
-        this.flushSink(this.buf.subarray(this.start, this.pos));
-        this.pos = this.start;
+        const installed = this.installs;
+        this.flushSink(this.buf, this.start, this.pos, needed);
+        if (this.installs === installed) {
+          this.start = 0;
+          this.origin = 0;
+          this.pos = 0;
+        }
       }
     }
     /**
@@ -509,14 +774,42 @@ var SofaBuffers = (function (exports) {
      * without interruption. `offset` reserves space at the front of the new
      * buffer. Any not-yet-flushed bytes in the old buffer are dropped, so
      * {@link flush} first (the flush callback fires before you swap).
+     *
+     * Every call is a **new installation**, and its `offset` applies to the unit
+     * it begins and is consumed when that unit is flushed (CORELIB_PLAN §5.1).
+     * Passing the buffer the encoder already has is an installation like any
+     * other: that is how a sink gets header room in *every* flushed unit — one
+     * framing header per packet — where returning bare would resume at `0`.
+     *
+     * On a stream that has a flush sink the new buffer must leave at least
+     * {@link MIN_OUTPUT_BUFFER} usable bytes (`buffer.length - offset`); a smaller
+     * one is rejected here, with {@link SofabErrorCode.Argument}, leaving the
+     * encoder on the buffer it already had. A sink-less stream has no minimum.
+     *
+     * `carried` says how many bytes **immediately before `offset`** the
+     * replacement already holds of *this* message — normally `0`, because a fresh
+     * buffer holds none. A caller that keeps the whole message in one growing
+     * store passes the length it copied across, so {@link bytes} keeps reporting
+     * the message rather than only the piece written after the swap. It changes
+     * nothing on the wire and nothing about flushing: the next flush still begins
+     * at `offset`. `growingOStream` is the caller this exists for; it is the
+     * §5.1.5 handover, not a growth hook inside the encoder (§6.6).
+     *
+     * The accumulating stream `growingOStream` builds is an ordinary streaming
+     * stream, so this works on it too, and means exactly what it means anywhere
+     * else: the not-yet-flushed bytes in the old buffer are dropped, encoding
+     * continues into yours, and its sink takes over growing *that* one from the
+     * next flush — reserve offset included, since what it copies out is the
+     * message rather than the buffer. Encode into a plain
+     * `new OStream(buffer, offset, flush?)` to keep the buffer yours instead.
      */
-    setBuffer(buffer, offset = 0) {
-      if (offset < 0 || offset > buffer.length) {
-        throw argumentError(`offset ${offset} out of range`);
-      }
+    setBuffer(buffer, offset = 0, carried = 0) {
+      checkHandover(buffer, offset, this.flushSink !== void 0, carried);
       this.buf = buffer;
       this.start = offset;
+      this.origin = offset - carried;
       this.pos = offset;
+      this.installs++;
     }
     /**
      * Rewind the encoder to empty, reusing the existing buffer. Lets a caller pool
@@ -524,7 +817,8 @@ var SofaBuffers = (function (exports) {
      * encode. Any view previously returned by {@link bytes} is invalidated.
      */
     reset() {
-      this.pos = this.start;
+      this.pos = this.origin;
+      this.start = this.origin;
       this.depth = 0;
       this.nPending = 0;
     }
@@ -537,9 +831,11 @@ var SofaBuffers = (function (exports) {
         return;
       }
       const v = toBigInt(value);
-      if (!inU64(v)) throw argumentError(`unsigned value ${v} out of 64-bit range`);
+      if (!splitU64(v)) throw argumentError(`unsigned value ${v} out of 64-bit range`);
+      const lo = S_U32[LO];
+      const hi = S_U32[HI];
       this.header(id, WireType.Unsigned);
-      this.putVarint(v);
+      this.putVarintLoHi(lo, hi);
     }
     /** Write a signed integer field (zig-zag encoded). */
     writeSigned(id, value) {
@@ -549,9 +845,44 @@ var SofaBuffers = (function (exports) {
         return;
       }
       const v = toBigInt(value);
-      if (!inI64(v)) throw argumentError(`signed value ${v} out of 64-bit range`);
+      if (!splitI64(v)) throw argumentError(`signed value ${v} out of 64-bit range`);
+      const lo = S_U32[LO];
+      const hi = S_U32[HI];
+      const sgn = -(hi >>> 31) >>> 0;
+      const zLo = (lo << 1 >>> 0 ^ sgn) >>> 0;
+      const zHi = ((hi << 1 | lo >>> 31) >>> 0 ^ sgn) >>> 0;
+      this.header(id, WireType.Signed);
+      this.putVarintLoHi(zLo, zHi);
+    }
+    /**
+     * Write an unsigned 64-bit scalar from a {@link Long} — the `bigint`-free twin
+     * of {@link writeUnsigned}, and the scalar counterpart of
+     * {@link writeUnsignedArrayLong}. Produces the identical wire.
+     *
+     * There is no range check and no scratch round-trip: a `Long` *is* two 32-bit
+     * halves, so it is in the `uint64` domain by construction — which is the whole
+     * of what `splitU64` decides for a `number | bigint`. The halves go straight
+     * into the varint writer, so nothing is allocated per value. Nothing needs
+     * copying out ahead of `header` either, for the same reason the array writers
+     * do not: the halves come off a caller-owned immutable `Long`, not the shared
+     * scratch a re-entrant flush sink could overwrite.
+     */
+    writeUnsignedLong(id, value) {
+      this.header(id, WireType.Unsigned);
+      this.putVarintLoHi(value.low, value.high);
+    }
+    /**
+     * Write a signed 64-bit scalar (zig-zag) from a {@link Long} — the
+     * `bigint`-free twin of {@link writeSigned}, and the scalar counterpart of
+     * {@link writeSignedArrayLong}. Zig-zag `(n << 1) ^ (n >> 63)` is computed on
+     * the lo/hi pair, so the varint goes out at its exact size (a fixed caller
+     * buffer must not see a 10-byte demand for a 2-byte field) and no `bigint` is
+     * created. A `Long` carries exactly 64 bits, so as in {@link writeUnsignedLong}
+     * there is nothing left to range-check.
+     */
+    writeSignedLong(id, value) {
       this.header(id, WireType.Signed);
-      this.putVarint(zigzagEncode(v));
+      this.putZigzagVarintLoHi(value.low, value.high);
     }
     /** Write a boolean field (encoded as the unsigned value 0 or 1). */
     writeBoolean(id, value) {
@@ -561,69 +892,161 @@ var SofaBuffers = (function (exports) {
     /** Write an IEEE-754 32-bit float field. */
     writeFp32(id, value) {
       this.fixlenHead(id, 4, FixlenSubtype.Fp32);
-      this.ensure(4);
-      this.pos = packFp32(this.buf, this.pos, value);
+      this.putFp32(value);
+    }
+    /**
+     * Write an fp32 field from its raw wire bits — the 4 little-endian payload
+     * bytes as one 32-bit word, which is exactly what {@link Visitor.fp32} delivers
+     * as `bits`.
+     *
+     * This is the re-encode half of the bit-exactness rule (CORELIB_PLAN §6.5). A JS
+     * `number` is a 64-bit double, and widening an fp32 **signaling** NaN into one
+     * quiets it, so re-encoding through {@link writeFp32} cannot reproduce such a
+     * payload; the bits go out verbatim here, so decode → re-encode is byte-for-byte
+     * for every fp32 value, sNaN included. §6.5 requires this path of every
+     * double-only target, and names it: "a 32-bit bits accessor".
+     */
+    writeFp32Bits(id, bits) {
+      this.fixlenHead(id, 4, FixlenSubtype.Fp32);
+      this.putFp32Bits(bits >>> 0);
     }
     /** Write an IEEE-754 64-bit double field. */
     writeFp64(id, value) {
       this.fixlenHead(id, 8, FixlenSubtype.Fp64);
-      this.ensure(8);
-      this.pos = packFp64(this.buf, this.pos, value);
+      this.putFp64(value);
     }
     /** Write a UTF-8 string field. */
     writeString(id, text) {
-      if (this.canGrow) {
-        const byteLen = utf8Length(text);
-        if (byteLen > FIXLEN_MAX) {
-          throw argumentError(`fixlen length ${byteLen} exceeds ${FIXLEN_MAX}`);
+      const n = text.length;
+      let a = 0;
+      while (a < n && text.charCodeAt(a) < 128) a++;
+      if (a === n) {
+        if (n > FIXLEN_MAX) {
+          throw argumentError(`fixlen length ${n} exceeds ${FIXLEN_MAX}`);
+        }
+        this.fixlenHead(id, n, FixlenSubtype.String);
+        if (this.reserveBulk(n)) {
+          const buf = this.buf;
+          const p = this.pos;
+          for (let k = 0; k < n; k++) buf[p + k] = text.charCodeAt(k);
+          this.pos = p + n;
+          return;
         }
-        this.fixlenHead(id, byteLen, FixlenSubtype.String);
-        this.ensure(byteLen);
+        utf8WriteSink(text, this);
+        return;
+      }
+      const byteLen = utf8Length(text);
+      if (byteLen > FIXLEN_MAX) {
+        throw argumentError(`fixlen length ${byteLen} exceeds ${FIXLEN_MAX}`);
+      }
+      this.fixlenHead(id, byteLen, FixlenSubtype.String);
+      if (this.reserveBulk(byteLen)) {
         this.pos = utf8Write(text, this.buf, this.pos);
         return;
       }
-      this.writeFixlen(id, encodeUtf8(text), FixlenSubtype.String);
+      utf8WriteSink(text, this);
     }
     /** Write a blob (arbitrary bytes) field. */
     writeBlob(id, data) {
       this.writeFixlen(id, data, FixlenSubtype.Blob);
     }
-    /** Write a fixed-length field of the given subtype from raw bytes. */
+    /**
+     * Write a fixed-length field of the given subtype from raw bytes.
+     *
+     * This is the byte-level entry point — the one writer that takes the subtype
+     * from the caller rather than picking it — so the payload is checked
+     * **against that subtype** before a byte is written, and it cannot emit a
+     * `fixlen_word` a conformant decoder must reject (`ARGUMENT`, §6.3):
+     *
+     * * subtypes `0x4`–`0x7` are **reserved** — a decoder must treat a field
+     *   carrying one as malformed (`INVALID`, §4.6/§5.2);
+     * * `Fp32` / `Fp64` payloads are **exactly** 4 / 8 bytes — any other declared
+     *   length for those subtypes is malformed, rejected the moment the word is
+     *   read (§4.6);
+     * * `String` / `Blob` take any length up to `FIXLEN_MAX`.
+     *
+     * The typed writers ({@link writeFp32}, {@link writeFp64},
+     * {@link writeString}) are correct by construction and go straight to the
+     * header; only {@link writeBlob}, whose subtype is unconstrained anyway,
+     * shares this path.
+     */
     writeFixlen(id, data, subtype) {
-      if (data.length > FIXLEN_MAX) {
+      if (subtype >>> 0 > FixlenSubtype.Blob || !Number.isInteger(subtype)) {
+        throw argumentError(`fixlen subtype ${subtype} is reserved (\xA74.6: 0x0..0x3)`);
+      }
+      if (subtype === FixlenSubtype.Fp32 || subtype === FixlenSubtype.Fp64) {
+        const want = subtype === FixlenSubtype.Fp32 ? 4 : 8;
+        if (data.length !== want) {
+          throw argumentError(
+            `fixlen ${subtype === FixlenSubtype.Fp32 ? "fp32" : "fp64"} payload must be exactly ${want} bytes, got ${data.length}`
+          );
+        }
+      } else if (data.length > FIXLEN_MAX) {
         throw argumentError(`fixlen length ${data.length} exceeds ${FIXLEN_MAX}`);
       }
       this.fixlenHead(id, data.length, subtype);
       this.writeRaw(data);
     }
     // --- arrays -------------------------------------------------------------
-    /** Write an array of unsigned integers (each a varint). */
+    /**
+     * Write an array of unsigned integers (each a varint).
+     *
+     * **The bulk kernel writes a whole array in one pass and cannot flush**, so it
+     * runs only where everything is known to fit. Three cases, and none of them
+     * asks the source how wide its elements are:
+     *
+     * * **block mode** (no sink) — the buffer is meant to hold the whole message,
+     *   so the kernel always runs and the buffer's length is the bound, checked
+     *   after the fact. A message that does not fit is `BUFFER_FULL`, which is
+     *   precisely this mode's answer.
+     * * **a stream with room** — `VARINT_MAX_BYTES` per element is the true
+     *   worst case for any 64-bit value, and a *growing* stream always satisfies
+     *   it because it grows to whatever is asked.
+     * * **a chunk too small for that** — fill it to the last byte, hand it over,
+     *   carry on, splitting an element where it falls. That is not a fallback but
+     *   the mode's contract: `MIN_OUTPUT_BUFFER` is 1.
+     *
+     * What is gone is the fourth case, which asked `values.constructor` for a
+     * narrower bound so the kernel would run on a tightly-sized chunk. `constructor`
+     * is an ordinary property, an `ArrayLike` can claim any width, and a wrong
+     * answer silently truncated the message — §5.1's "partial output handed back as
+     * complete". The block mode now reaches the kernel without needing the number
+     * at all, which is where a tightly-sized buffer actually lives.
+     */
     writeUnsignedArray(id, values) {
       this.arrayHead(id, WireType.ArrayUnsigned, values.length);
-      if (this.canGrow) {
-        this.ensure(values.length * VARINT_MAX_BYTES);
+      if (this.flushSink === void 0) {
+        this.pos = this.bulkEnd(
+          this.kernel.encodeUnsignedVarints(values, this.buf, this.pos),
+          values.length
+        );
+      } else if (this.reserveBulk(values.length * VARINT_MAX_BYTES)) {
         this.pos = this.kernel.encodeUnsignedVarints(values, this.buf, this.pos);
       } else {
         for (let i = 0; i < values.length; i++) {
           const v = toBigInt(values[i]);
-          if (!inU64(v)) throw argumentError(`unsigned value ${v} out of range`);
-          this.ensure(VARINT_MAX_BYTES);
-          this.pos = encodeVarint(v, this.buf, this.pos);
+          if (!splitU64(v)) throw argumentError(`unsigned value ${v} out of range`);
+          const lo = S_U32[LO];
+          const hi = S_U32[HI];
+          this.putVarintLoHi(lo, hi);
         }
       }
     }
-    /** Write an array of signed integers (each zig-zag + varint). */
+    /** Write an array of signed integers (each zig-zag + varint). See {@link writeUnsignedArray}. */
     writeSignedArray(id, values) {
       this.arrayHead(id, WireType.ArraySigned, values.length);
-      if (this.canGrow) {
-        this.ensure(values.length * VARINT_MAX_BYTES);
+      if (this.flushSink === void 0) {
+        this.pos = this.bulkEnd(
+          this.kernel.encodeSignedVarints(values, this.buf, this.pos),
+          values.length
+        );
+      } else if (this.reserveBulk(values.length * VARINT_MAX_BYTES)) {
         this.pos = this.kernel.encodeSignedVarints(values, this.buf, this.pos);
       } else {
         for (let i = 0; i < values.length; i++) {
           const v = toBigInt(values[i]);
-          if (!inI64(v)) throw argumentError(`signed value ${v} out of range`);
-          this.ensure(VARINT_MAX_BYTES);
-          this.pos = encodeVarint(zigzagEncode(v), this.buf, this.pos);
+          if (!splitI64(v)) throw argumentError(`signed value ${v} out of range`);
+          this.putZigzagVarintLoHi(S_U32[LO], S_U32[HI]);
         }
       }
     }
@@ -634,14 +1057,20 @@ var SofaBuffers = (function (exports) {
      */
     writeUnsignedArrayLong(id, values) {
       this.arrayHead(id, WireType.ArrayUnsigned, values.length);
-      this.ensure(values.length * VARINT_MAX_BYTES);
-      let pos = this.pos;
-      const buf = this.buf;
-      for (let i = 0; i < values.length; i++) {
-        const v = values[i];
-        pos = encodeVarintLoHi(v.low, v.high, buf, pos);
+      if (this.reserveBulk(values.length * VARINT_MAX_BYTES)) {
+        let pos = this.pos;
+        const buf = this.buf;
+        for (let i = 0; i < values.length; i++) {
+          const v = values[i];
+          pos = encodeVarintLoHi(v.low, v.high, buf, pos);
+        }
+        this.pos = pos;
+      } else {
+        for (let i = 0; i < values.length; i++) {
+          const v = values[i];
+          this.putVarintLoHi(v.low, v.high);
+        }
       }
-      this.pos = pos;
     }
     /**
      * Write a signed 64-bit array (zig-zag) from {@link Long}[] — the `bigint`-free
@@ -649,32 +1078,33 @@ var SofaBuffers = (function (exports) {
      */
     writeSignedArrayLong(id, values) {
       this.arrayHead(id, WireType.ArraySigned, values.length);
-      this.ensure(values.length * VARINT_MAX_BYTES);
-      let pos = this.pos;
-      const buf = this.buf;
-      for (let i = 0; i < values.length; i++) {
-        const v = values[i];
-        const lo = v.low;
-        const hi = v.high;
-        const sgn = -(hi >>> 31) >>> 0;
-        const zLo = (lo << 1 >>> 0 ^ sgn) >>> 0;
-        const zHi = ((hi << 1 | lo >>> 31) >>> 0 ^ sgn) >>> 0;
-        pos = encodeVarintLoHi(zLo, zHi, buf, pos);
+      if (this.reserveBulk(values.length * VARINT_MAX_BYTES)) {
+        let pos = this.pos;
+        const buf = this.buf;
+        for (let i = 0; i < values.length; i++) {
+          const v = values[i];
+          pos = encodeZigzagVarintLoHi(v.low, v.high, buf, pos);
+        }
+        this.pos = pos;
+      } else {
+        for (let i = 0; i < values.length; i++) {
+          const v = values[i];
+          this.putZigzagVarintLoHi(v.low, v.high);
+        }
       }
-      this.pos = pos;
     }
     /** Write an array of IEEE-754 32-bit floats. */
     writeFp32Array(id, values) {
+      if (values instanceof Float32Array) {
+        this.writeFp32Words(id, values);
+        return;
+      }
       this.arrayHead(id, WireType.ArrayFixlen, values.length);
       this.putVarintNum(4 * 8 + FixlenSubtype.Fp32);
-      if (this.canGrow) {
-        this.ensure(values.length * 4);
+      if (this.reserveBulk(values.length * 4)) {
         this.pos = this.kernel.packFp32Array(values, this.buf, this.pos);
       } else {
-        for (let i = 0; i < values.length; i++) {
-          this.ensure(4);
-          this.pos = packFp32(this.buf, this.pos, values[i]);
-        }
+        for (let i = 0; i < values.length; i++) this.putFp32(values[i]);
       }
     }
     /**
@@ -698,14 +1128,10 @@ var SofaBuffers = (function (exports) {
     writeFp64Array(id, values) {
       this.arrayHead(id, WireType.ArrayFixlen, values.length);
       this.putVarintNum(8 * 8 + FixlenSubtype.Fp64);
-      if (this.canGrow) {
-        this.ensure(values.length * 8);
+      if (this.reserveBulk(values.length * 8)) {
         this.pos = this.kernel.packFp64Array(values, this.buf, this.pos);
       } else {
-        for (let i = 0; i < values.length; i++) {
-          this.ensure(8);
-          this.pos = packFp64(this.buf, this.pos, values[i]);
-        }
+        for (let i = 0; i < values.length; i++) this.putFp64(values[i]);
       }
     }
     // --- sequences ----------------------------------------------------------
@@ -729,7 +1155,7 @@ var SofaBuffers = (function (exports) {
       if (this.depth >= MAX_DEPTH) {
         throw argumentError(`nesting exceeds MAX_DEPTH (${MAX_DEPTH})`);
       }
-      if (id < 0 || id > ID_MAX || !Number.isInteger(id)) {
+      if (id >>> 0 !== id || id > ID_MAX) {
         throw argumentError(`field id ${id} out of range 0..${ID_MAX}`);
       }
       this.pending[this.nPending++] = id;
@@ -787,15 +1213,230 @@ var SofaBuffers = (function (exports) {
       if (this.depth > 0) this.depth--;
     }
     // --- internals ----------------------------------------------------------
-    /** Ensure exactly `value`'s varint size, then write it (bigint path). */
-    putVarint(value) {
-      this.ensure(varintSize(value));
-      this.pos = encodeVarint(value, this.buf, this.pos);
-    }
     /** Ensure exactly `value`'s varint size, then write it (number fast path). */
     putVarintNum(value) {
-      this.ensure(varintSizeNum(value));
-      this.pos = encodeVarintNum(value, this.buf, this.pos);
+      const pos = this.pos;
+      if (value < 128 && pos < this.buf.length) {
+        this.buf[pos] = value;
+        this.pos = pos + 1;
+        return;
+      }
+      this.putVarintNumSlow(value);
+    }
+    /**
+     * The multi-byte / needs-room tail of {@link putVarintNum}, kept in its own
+     * method so the single-byte test above stays small enough for the JIT to
+     * inline into every `header` / `fixlenHead` / `arrayHead` call site.
+     */
+    putVarintNumSlow(value) {
+      if (this.tryEnsure(varintSizeNum(value))) {
+        this.pos = encodeVarintNum(value, this.buf, this.pos);
+        return;
+      }
+      while (value > 127) {
+        this.putByte(value % 128 | 128);
+        value = Math.floor(value / 128);
+      }
+      this.putByte(value);
+    }
+    /**
+     * Write a 64-bit value, held as two 32-bit halves, as a varint.
+     *
+     * Deliberately just a bounds check and two calls: this is what the array
+     * loops call per element, and it only pays its way while it is small enough
+     * for the JIT to inline. Spelling the drain case out here instead — three
+     * more lines — cost 16-19% on an array streamed through a 32/64-byte buffer,
+     * where most elements take the fast path and want it inlined.
+     */
+    putVarintLoHi(lo, hi) {
+      if (this.buf.length - this.pos >= VARINT_MAX_BYTES) {
+        this.pos = encodeVarintLoHi(lo, hi, this.buf, this.pos);
+        return;
+      }
+      this.putVarintLoHiSlow(lo, hi);
+    }
+    /**
+     * A full buffer that is nonetheless wide enough to hold any varint: drain it
+     * and retry the worst case, which is exactly what `ensure(VARINT_MAX_BYTES)`
+     * did before §5.1 and is still the common streaming case. Sizing the value
+     * first instead — the narrow-buffer path in {@link putVarintLoHiTight} — cost
+     * +125 instructions on every element of an array streamed through a
+     * one-element-wide buffer.
+     */
+    putVarintLoHiSlow(lo, hi) {
+      if (this.buf.length - this.start >= VARINT_MAX_BYTES) {
+        this.flush();
+        if (this.buf.length - this.pos >= VARINT_MAX_BYTES) {
+          this.pos = encodeVarintLoHi(lo, hi, this.buf, this.pos);
+          return;
+        }
+      }
+      this.putVarintLoHiTight(lo, hi);
+    }
+    /**
+     * Zig-zag {@link putVarintLoHi}: `(n << 1) ^ (n >> 63)` on the halves. Keeps
+     * its own worst-case fast path so the signed array loop reaches the combined
+     * zig-zag-and-encode writer directly, exactly as it did before; the drain and
+     * narrow-buffer cases are the same for both signs, so they are shared.
+     */
+    putZigzagVarintLoHi(lo, hi) {
+      if (this.buf.length - this.pos >= VARINT_MAX_BYTES) {
+        this.pos = encodeZigzagVarintLoHi(lo, hi, this.buf, this.pos);
+        return;
+      }
+      const sgn = -(hi >>> 31) >>> 0;
+      this.putVarintLoHi(
+        (lo << 1 >>> 0 ^ sgn) >>> 0,
+        ((hi << 1 | lo >>> 31) >>> 0 ^ sgn) >>> 0
+      );
+    }
+    /**
+     * The narrow-buffer tail of {@link putVarintLoHi}: the buffer could not hold a
+     * worst-case varint even empty. Sizing the value exactly keeps such a buffer
+     * from flushing for room it does not need; only when it cannot hold the varint
+     * *at all* does the value get split across flushes, seven bits at a time.
+     */
+    putVarintLoHiTight(lo, hi) {
+      lo >>>= 0;
+      hi >>>= 0;
+      if (this.tryEnsure(varintSizeLoHi(lo, hi))) {
+        this.pos = encodeVarintLoHi(lo, hi, this.buf, this.pos);
+        return;
+      }
+      for (; ; ) {
+        const more = hi !== 0 || lo > 127;
+        this.putByte(more ? lo & 127 | 128 : lo);
+        if (!more) return;
+        lo = (lo >>> 7 | hi << 25) >>> 0;
+        hi >>>= 7;
+      }
+    }
+    /**
+     * Write the 4 little-endian bytes of an fp32 (§4.6).
+     *
+     * Through the shared scratch, not a `DataView` over the buffer: building that
+     * handle costs ~129 ns against the ~2 ns it saves on one value (§6.6.2 allows the
+     * handle, arithmetic forbids it here). The bulk array path amortizes one over the
+     * whole run instead — see the kernel.
+     */
+    putFp32(value) {
+      if (this.buf.length - this.pos >= 4) {
+        this.pos = packFp32(this.buf, this.pos, value);
+        return;
+      }
+      this.putFp32Slow(value);
+    }
+    putFp32Slow(value) {
+      if (this.tryEnsure(4)) {
+        this.pos = packFp32(this.buf, this.pos, value);
+        return;
+      }
+      this.putFp32Bits(fp32Bits(value));
+    }
+    /**
+     * Write the 4 little-endian bytes of an fp32 held as a 32-bit word (§4.6) — the
+     * path {@link OStream.writeFp32Bits} takes, and the tail of
+     * {@link OStream.putFp32Slow}.
+     */
+    putFp32Bits(bits) {
+      if (this.buf.length - this.pos >= 4) {
+        const buf = this.buf;
+        let p = this.pos;
+        buf[p++] = bits & 255;
+        buf[p++] = bits >>> 8 & 255;
+        buf[p++] = bits >>> 16 & 255;
+        buf[p++] = bits >>> 24;
+        this.pos = p;
+        return;
+      }
+      this.putByte(bits & 255);
+      this.putByte(bits >>> 8 & 255);
+      this.putByte(bits >>> 16 & 255);
+      this.putByte(bits >>> 24);
+    }
+    /**
+     * {@link writeFp32Array} for a `Float32Array` source: its own 32-bit words go
+     * out, never a `number`, which is what keeps a signaling NaN intact (§6.5) —
+     * on the bulk path (the kernel copies words too) and on the streamed one alike,
+     * so a small buffer produces the one-shot bytes (§5.1.4).
+     *
+     * Kept to the header and the bulk call, the streaming loop in its own method:
+     * with the loop in this body an 8-element one-shot array cost +416 Ir/op
+     * (+8.8%) over the pre-#185 encoder, split like this +1.1% (Callgrind).
+     */
+    writeFp32Words(id, values) {
+      this.arrayHead(id, WireType.ArrayFixlen, values.length);
+      this.putVarintNum(4 * 8 + FixlenSubtype.Fp32);
+      if (this.reserveBulk(values.length * 4)) {
+        this.pos = this.kernel.packFp32Array(values, this.buf, this.pos);
+      } else {
+        this.putFp32Words(values);
+      }
+    }
+    /**
+     * The streamed half of {@link writeFp32Words}: one `Uint32Array` over the
+     * source per call, the same handle the bulk kernel takes (§6.6.2); reading it gives each word's value whatever the
+     * host byte order, and the shifts below store it little-endian. The words go
+     * out one run per stretch of free buffer, with `buf`/`pos` in locals, and the
+     * split points are {@link putFp32}'s: drain when fewer than 4 bytes are free,
+     * split an element byte by byte only when the buffer itself is narrower than 4.
+     */
+    putFp32Words(values) {
+      const w = new Uint32Array(values.buffer, values.byteOffset, values.length);
+      const n = w.length;
+      let i = 0;
+      while (i < n) {
+        if (this.buf.length - this.pos < 4 && !this.tryEnsure(4)) {
+          this.putFp32Bits(w[i++]);
+          continue;
+        }
+        const buf = this.buf;
+        let p = this.pos;
+        const end = Math.min(n, i + (buf.length - p >> 2));
+        for (; i < end; i++) {
+          const b = w[i];
+          buf[p] = b & 255;
+          buf[p + 1] = b >>> 8 & 255;
+          buf[p + 2] = b >>> 16 & 255;
+          buf[p + 3] = b >>> 24;
+          p += 4;
+        }
+        this.pos = p;
+      }
+    }
+    /** Write the 8 little-endian bytes of an fp64 (§4.6) — see {@link putFp32}. */
+    putFp64(value) {
+      if (this.buf.length - this.pos >= 8) {
+        this.pos = packFp64(this.buf, this.pos, value);
+        return;
+      }
+      this.putFp64Slow(value);
+    }
+    putFp64Slow(value) {
+      if (this.tryEnsure(8)) {
+        this.pos = packFp64(this.buf, this.pos, value);
+        return;
+      }
+      const lo = fp64BitsLo(value);
+      const hi = fp64BitsHi(value);
+      this.putByte(lo & 255);
+      this.putByte(lo >>> 8 & 255);
+      this.putByte(lo >>> 16 & 255);
+      this.putByte(lo >>> 24);
+      this.putByte(hi & 255);
+      this.putByte(hi >>> 8 & 255);
+      this.putByte(hi >>> 16 & 255);
+      this.putByte(hi >>> 24);
+    }
+    /**
+     * Append one byte, draining to the sink first when the buffer is full.
+     *
+     * @internal Public only because {@link utf8WriteSink} writes through it — the
+     * narrow-buffer string path (§5.1.3). Not part of the field-writing API.
+     */
+    putByte(b) {
+      if (this.pos === this.buf.length) this.ensureSome(1);
+      this.buf[this.pos++] = b;
     }
     /**
      * Write a field header, the `(id << 3) | wireType` tag, as a varint.
@@ -814,7 +1455,7 @@ var SofaBuffers = (function (exports) {
      * {@link OStream.writeSequenceBeginLazy}, which writes no byte at all.
      */
     header(id, type) {
-      if (id < 0 || id > ID_MAX || !Number.isInteger(id)) {
+      if (id >>> 0 !== id || id > ID_MAX) {
         throw argumentError(`field id ${id} out of range 0..${ID_MAX}`);
       }
       if (this.nPending !== 0) this.commitPending();
@@ -831,8 +1472,9 @@ var SofaBuffers = (function (exports) {
     commitPending() {
       const n = this.nPending;
       this.nPending = 0;
+      const pending = this.pending;
       for (let i = 0; i < n; i++) {
-        this.putVarintNum(this.pending[i] * 8 + WireType.SequenceStart);
+        this.putVarintNum(pending[i] * 8 + WireType.SequenceStart);
       }
     }
     fixlenHead(id, length, subtype) {
@@ -846,332 +1488,335 @@ var SofaBuffers = (function (exports) {
       this.header(id, type);
       this.putVarintNum(count);
     }
-    /** Copy `data` out, flushing/growing as needed (large payloads stay chunked). */
+    /**
+     * Copy `data` out, flushing/growing as needed (large payloads stay chunked).
+     *
+     * The whole-payload case — the common one, and the only one on a buffer sized
+     * from `MAX_SIZE` or on the accumulator — is a single `set` of the caller's
+     * array: a `memcpy`, and no view at all.
+     *
+     * **A payload split across flushes takes a per-piece view: a language-forced
+     * handle under CORELIB_PLAN §6.6.2.** `TypedArray.set` is the only `memcpy`
+     * this language exposes and it takes a *typed array* as its source, so copying a
+     * *range* of one needs a `subarray` — §6.6.2's "the only way to name a region of
+     * the caller's buffer is a wrapper over it". It has the two properties that
+     * clause requires: it carries no message bytes (the storage is the caller's, on
+     * both ends) and no wire number sizes it (a handle over a thousand bytes costs
+     * what a handle over ten costs). The allocation-free alternative is a byte loop,
+     * measured at 358 MB/s against 10,963 MB/s for `set`.
+     *
+     * It never leaves this method: `set` consumes it and no caller can reach it, so
+     * §6.7's ban on exposing a value that outlives its callback is untouched — and so
+     * is §5.1.6, which is why the copy happens at all rather than the payload being
+     * handed to the sink. §6.6.2 asks the port to make such handles visible rather
+     * than invisible: the README itemises it (§9.6) and `heap-free-codec.test.ts`
+     * pins its count and kind.
+     */
     writeRaw(data) {
+      const total = data.length;
       let off = 0;
-      while (off < data.length) {
-        const room = this.ensureSome(data.length - off);
-        this.buf.set(data.subarray(off, off + room), this.pos);
+      while (off < total) {
+        const room = this.ensureSome(total - off);
+        if (off === 0 && room === total) {
+          this.buf.set(data, this.pos);
+        } else {
+          this.buf.set(data.subarray(off, off + room), this.pos);
+        }
         this.pos += room;
         off += room;
       }
     }
-    /** Ensure `n` contiguous bytes are free at `pos`; returns `pos` for chaining. */
-    ensure(n) {
-      if (this.buf.length - this.pos >= n) return this.pos;
-      this.flush();
-      if (this.buf.length - this.pos >= n) return this.pos;
-      if (this.canGrow) {
-        this.growTo(this.pos + n);
-        return this.pos;
-      }
-      throw bufferFullError(
-        `output buffer full: need ${n} more bytes, have ${this.buf.length - this.pos}`
-      );
+    /**
+     * Make room for `n` contiguous bytes at `pos` if the buffer can hold them at
+     * all: `true` when it can (flushing or growing as needed), `false` when a
+     * fixed caller buffer is simply smaller than `n` and the value must be split
+     * across flushes instead — CORELIB_PLAN §5.1 puts the floor on the output
+     * buffer at a single byte, so no write may demand a contiguous run.
+     *
+     * The one case that still fails is a buffer with no sink to drain to: there is
+     * nowhere for a split to put the earlier bytes, so it reports BufferFull here,
+     * before anything is written, exactly as {@link ensure} did.
+     */
+    tryEnsure(n) {
+      if (this.buf.length - this.pos >= n) return true;
+      this.drain(n);
+      if (this.buf.length - this.pos >= n) return true;
+      if (this.flushSink === void 0) {
+        throw bufferFullError(
+          `output buffer full: need ${n} more bytes, have ${this.buf.length - this.pos}`
+        );
+      }
+      return false;
     }
-    /** Ensure *some* room (up to `want`); returns how many bytes are available. */
-    ensureSome(want) {
-      let room = this.buf.length - this.pos;
-      if (room === 0) {
-        this.flush();
-        room = this.buf.length - this.pos;
-        if (room === 0) {
-          if (this.canGrow) {
-            this.growTo(this.pos + want);
-            room = this.buf.length - this.pos;
-          } else {
-            throw bufferFullError("output buffer full");
-          }
-        }
-      }
-      return Math.min(room, want);
-    }
-    growTo(needed) {
-      let cap = this.buf.length * 2;
-      if (cap < needed) cap = needed;
-      const next = new Uint8Array(cap);
-      next.set(this.buf.subarray(0, this.pos));
-      this.buf = next;
+    /**
+     * Reserve `n` contiguous bytes for a bulk write — the whole payload of an
+     * array or a string, written in one pass into a buffer that cannot move under
+     * it. Every caller has an element-at-a-time route to fall back on when this
+     * says no, producing the identical bytes, so a `false` here is never an error.
+     *
+     * The room already at the cursor counts on **any** buffer, which is what makes
+     * the one-shot `new OStream(buf)` case — a caller buffer sized from the
+     * schema's `MAX_SIZE`, the shape CORELIB_PLAN §5.1 puts first — the fast one:
+     * without it a message encoded into a caller's own buffer took `TextEncoder`
+     * for every string and the element loop for every array, measured at 1.9 µs
+     * against 0.16 µs for the same five-field message.
+     *
+     * Beyond that room only a **sink** may be asked, and only by draining. Emptying
+     * the buffer is the one thing that can produce room without an allocation
+     * anywhere (§6.6), and it is legal wherever this is called — every caller has
+     * just written a complete header, so the cursor is on a boundary between atomic
+     * units (§5.1.3). A sink that installs a larger replacement (§5.1.5) therefore
+     * re-opens the bulk route by itself, which is how the accumulating helper keeps
+     * it. Nothing is *demanded*: a `false` sends the caller down its
+     * element-at-a-time route, which produces the identical bytes, so a fixed
+     * buffer too narrow for the worst case never turns into a spurious
+     * `BUFFER_FULL`.
+     */
+    reserveBulk(n) {
+      if (this.buf.length - this.pos >= n) return true;
+      if (this.flushSink === void 0) return false;
+      this.drain(n);
+      return this.buf.length - this.pos >= n;
     }
-  };
-
-  // src/decode/fast.ts
-  var TWO32 = 4294967296;
-  function decodeContiguous(buf, root, limits) {
-    new FastDecoder(buf, limits).run(root);
-  }
-  var FastDecoder = class {
-    constructor(buf, limits) {
-      this.p = 0;
-      // Last varint, as two unsigned 32-bit halves (see readVarint).
-      this.lo = 0;
-      this.hi = 0;
-      this.buf = buf;
-      this.n = buf.length;
-      this.view = new DataView(buf.buffer, buf.byteOffset, buf.length);
-      this.maxArrayCount = limits?.maxArrayCount ?? Infinity;
-      this.maxStringLen = limits?.maxStringLen ?? Infinity;
-      this.maxBlobLen = limits?.maxBlobLen ?? Infinity;
-    }
-    run(root) {
-      const stack = [root];
-      let top = root;
-      while (this.p < this.n) {
-        this.readVarint();
-        const type = this.lo & 7;
-        if (type === WireType.SequenceEnd) {
-          if (stack.length <= 1) throw invalidMsgError("unbalanced sequence end");
-          top.sequenceEnd?.();
-          stack.pop();
-          top = stack[stack.length - 1];
-          continue;
-        }
-        const id = this.upper();
-        if (id > ID_MAX) throw invalidMsgError(`field id ${id} out of range`);
-        switch (type) {
-          case WireType.Unsigned: {
-            this.readVarint();
-            top.unsigned?.(id, this.unsignedValue());
-            break;
-          }
-          case WireType.Signed: {
-            this.readVarint();
-            top.signed?.(id, this.signedValue());
-            break;
-          }
-          case WireType.Fixlen: {
-            this.readVarint();
-            const sub = this.lo & 7;
-            const len = this.upper();
-            if (sub > FixlenSubtype.Blob) throw invalidMsgError(`invalid fixlen subtype ${sub}`);
-            if (len > FIXLEN_MAX) throw invalidMsgError("fixlen length out of range");
-            if (sub === FixlenSubtype.String && len > this.maxStringLen) {
-              throw limitExceededError(`string length ${len} exceeds maxStringLen ${this.maxStringLen}`);
-            }
-            if (sub === FixlenSubtype.Blob && len > this.maxBlobLen) {
-              throw limitExceededError(`blob length ${len} exceeds maxBlobLen ${this.maxBlobLen}`);
-            }
-            if (sub === FixlenSubtype.Fp32 || sub === FixlenSubtype.Fp64) {
-              const want = sub === FixlenSubtype.Fp32 ? 4 : 8;
-              if (len !== want) throw invalidMsgError("fixlen float length mismatch");
-              if (sub === FixlenSubtype.Fp32) {
-                const p = this.p;
-                const value = this.readFp32();
-                top.fp32?.(id, value, top.fp32Raw ? this.buf.subarray(p, p + 4) : void 0);
-              } else {
-                const value = this.readFp64();
-                top.fp64?.(id, value);
-              }
-            } else {
-              const chunk = this.take(len);
-              if (sub === FixlenSubtype.String) top.string?.(id, len, 0, chunk);
-              else top.blob?.(id, len, 0, chunk);
-            }
-            break;
-          }
-          case WireType.ArrayUnsigned: {
-            const count = this.arrayCount();
-            top.arrayBegin?.(id, ArrayKind.Unsigned, count);
-            for (let i = 0; i < count; i++) {
-              this.readVarint();
-              top.arrayUnsigned?.(id, i, this.unsignedValue());
-            }
-            top.arrayEnd?.(id);
-            break;
-          }
-          case WireType.ArraySigned: {
-            const count = this.arrayCount();
-            top.arrayBegin?.(id, ArrayKind.Signed, count);
-            for (let i = 0; i < count; i++) {
-              this.readVarint();
-              top.arraySigned?.(id, i, this.signedValue());
-            }
-            top.arrayEnd?.(id);
-            break;
-          }
-          case WireType.ArrayFixlen: {
-            const count = this.arrayCount();
-            this.readVarint();
-            const sub = this.lo & 7;
-            const size = this.upper();
-            let kind;
-            if (sub === FixlenSubtype.Fp32 && size === 4) kind = ArrayKind.Fp32;
-            else if (sub === FixlenSubtype.Fp64 && size === 8) kind = ArrayKind.Fp64;
-            else throw invalidMsgError("invalid fixlen array element type");
-            top.arrayBegin?.(id, kind, count);
-            if (kind === ArrayKind.Fp32) {
-              const wantRaw = top.fp32Raw === true;
-              for (let i = 0; i < count; i++) {
-                const p = this.p;
-                const value = this.readFp32();
-                top.arrayFp32?.(id, i, value, wantRaw ? this.buf.subarray(p, p + 4) : void 0);
-              }
-            } else {
-              for (let i = 0; i < count; i++) {
-                const value = this.readFp64();
-                top.arrayFp64?.(id, i, value);
-              }
-            }
-            top.arrayEnd?.(id);
-            break;
-          }
-          case WireType.SequenceStart: {
-            if (stack.length - 1 >= MAX_DEPTH) {
-              throw invalidMsgError(`nesting exceeds MAX_DEPTH (${MAX_DEPTH})`);
-            }
-            const child = top.sequenceBegin?.(id);
-            top = child ?? top;
-            stack.push(top);
-            break;
-          }
-          default:
-            throw invalidMsgError(`invalid wire type ${type}`);
-        }
-      }
-      if (stack.length > 1) throw incompleteError("truncated message: unbalanced sequence");
-    }
-    // --- field helpers ------------------------------------------------------
-    /** Read and validate an array count word (0..ARRAY_MAX; §4.7/§4.8). */
-    arrayCount() {
-      this.readVarint();
-      const count = this.num();
-      if (count > ARRAY_MAX) throw invalidMsgError("array count out of range");
-      if (count > this.maxArrayCount) {
-        throw limitExceededError(`array count ${count} exceeds maxArrayCount ${this.maxArrayCount}`);
-      }
-      return count;
-    }
-    /** Hand back a zero-copy view of the next `len` bytes, advancing the cursor. */
-    take(len) {
-      const start = this.p;
-      const end = start + len;
-      if (end > this.n) throw incompleteError("truncated fixlen payload");
-      this.p = end;
-      return this.buf.subarray(start, end);
-    }
-    readFp32() {
-      const p = this.p;
-      if (p + 4 > this.n) throw incompleteError("truncated fp32");
-      this.p = p + 4;
-      return this.view.getFloat32(p, true);
-    }
-    readFp64() {
-      const p = this.p;
-      if (p + 8 > this.n) throw incompleteError("truncated fp64");
-      this.p = p + 8;
-      return this.view.getFloat64(p, true);
-    }
-    // --- varint reading -----------------------------------------------------
-    /** The last varint's full value as a `bigint` (64-bit fidelity). */
-    big() {
-      return this.hi === 0 ? BigInt(this.lo >>> 0) : BigInt(this.hi >>> 0) << 32n | BigInt(this.lo >>> 0);
-    }
-    /**
-     * The last varint as an unsigned value, number-first: a `number` when it fits
-     * exactly (`≤ 2^53-1` — all ids, u8..u32 and small u64s), a `bigint` only
-     * beyond that. Skips the per-value bigint allocation on the common path.
-     */
-    unsignedValue() {
-      const hi = this.hi >>> 0;
-      return hi <= 2097151 ? hi * TWO32 + (this.lo >>> 0) : this.big();
-    }
-    /** The last zig-zag varint as a signed value, number-first (see {@link unsignedValue}). */
-    signedValue() {
-      const hi = this.hi >>> 0;
-      if (hi <= 2097151) {
-        const r = hi * TWO32 + (this.lo >>> 0);
-        return r % 2 === 0 ? r / 2 : -(r + 1) / 2;
+    /**
+     * Commit the position a bulk kernel returned, in the **block** mode.
+     *
+     * Nothing reserves room in front of that kernel, and nothing could: the bytes an
+     * array takes are only known once it is encoded, and the estimate that used to
+     * stand in — the source's own `constructor`, which any object can set — silently
+     * truncated the message when it was wrong (§5.1). Here the bound is the buffer's
+     * own length, applied afterwards. The varint kernels stop writing at
+     * `out.length` and keep counting (see {@link Kernel}), so a `pos` past the end
+     * is the exact shortfall and nothing was written outside the buffer.
+     *
+     * This is the block mode's error and only its: the buffer is meant to hold the
+     * whole message, so one that does not fit is exactly what `BUFFER_FULL` means.
+     * The streaming mode never gets here, and `BUFFER_FULL` is unreachable there by
+     * contract.
+     */
+    bulkEnd(pos, count) {
+      if (pos > this.buf.length) {
+        throw bufferFullError(
+          `output buffer full: an array of ${count} elements needs ${pos - this.buf.length} more bytes`
+        );
       }
-      return zigzagDecode(this.big());
-    }
-    /** The last varint's value as a JS number — exact for ids/lengths/counts. */
-    num() {
-      return this.hi * TWO32 + (this.lo >>> 0);
-    }
-    /** The last varint with its low 3 tag bits stripped (`value >> 3`). */
-    upper() {
-      return (this.hi >>> 0) * (TWO32 / 8) + (this.lo >>> 3);
+      return pos;
     }
     /**
-     * Decode one LEB128 varint at the cursor into {@link lo} / {@link hi} (each an
-     * unsigned 32-bit half), advancing {@link p}. Throws on truncation or a value
-     * spilling past 64 bits (>10 bytes). Unrolled, number-only — no `bigint`.
+     * Ensure `n` contiguous bytes are free at `pos`; returns `pos` for chaining.
+     *
+     * The only remaining caller is the one-byte sequence-end marker, which is
+     * indivisible: there is no smaller piece to split it into, so a buffer that
+     * cannot take it has nothing left to report but `BUFFER_FULL`.
      */
-    readVarint() {
-      const buf = this.buf;
-      const n = this.n;
-      let p = this.p;
-      let b;
-      let lo;
-      let hi = 0;
-      if (p >= n) throw incompleteError("truncated varint");
-      b = buf[p++];
-      lo = b & 127;
-      if (b < 128) return this.set(lo, 0, p);
-      if (p >= n) throw incompleteError("truncated varint");
-      b = buf[p++];
-      lo |= (b & 127) << 7;
-      if (b < 128) return this.set(lo, 0, p);
-      if (p >= n) throw incompleteError("truncated varint");
-      b = buf[p++];
-      lo |= (b & 127) << 14;
-      if (b < 128) return this.set(lo, 0, p);
-      if (p >= n) throw incompleteError("truncated varint");
-      b = buf[p++];
-      lo |= (b & 127) << 21;
-      if (b < 128) return this.set(lo, 0, p);
-      if (p >= n) throw incompleteError("truncated varint");
-      b = buf[p++];
-      lo |= (b & 15) << 28;
-      hi = b >> 4 & 7;
-      if (b < 128) return this.set(lo, hi, p);
-      if (p >= n) throw incompleteError("truncated varint");
-      b = buf[p++];
-      hi |= (b & 127) << 3;
-      if (b < 128) return this.set(lo, hi, p);
-      if (p >= n) throw incompleteError("truncated varint");
-      b = buf[p++];
-      hi |= (b & 127) << 10;
-      if (b < 128) return this.set(lo, hi, p);
-      if (p >= n) throw incompleteError("truncated varint");
-      b = buf[p++];
-      hi |= (b & 127) << 17;
-      if (b < 128) return this.set(lo, hi, p);
-      if (p >= n) throw incompleteError("truncated varint");
-      b = buf[p++];
-      hi |= (b & 127) << 24;
-      if (b < 128) return this.set(lo, hi, p);
-      if (p >= n) throw incompleteError("truncated varint");
-      b = buf[p++];
-      if ((b & 127) >> 1 !== 0) throw invalidMsgError("varint overflow");
-      hi |= (b & 127) << 31;
-      if (b < 128) return this.set(lo, hi, p);
-      throw invalidMsgError("varint overflow");
+    ensure(n) {
+      if (!this.tryEnsure(n)) {
+        throw bufferFullError(
+          `output buffer full: need ${n} more bytes, have ${this.buf.length - this.pos}`
+        );
+      }
+      return this.pos;
     }
-    set(lo, hi, p) {
-      this.lo = lo;
-      this.hi = hi;
-      this.p = p;
+    /** Ensure *some* room (up to `want`); returns how many bytes are available. */
+    ensureSome(want) {
+      let room = this.buf.length - this.pos;
+      if (room === 0) {
+        this.flush();
+        room = this.buf.length - this.pos;
+        if (room === 0) throw bufferFullError("output buffer full");
+      }
+      return Math.min(room, want);
     }
   };
 
+  // src/encode/accumulate.ts
+  var DEFAULT_CAPACITY = 256;
+  var MIN_WINDOW = 16;
+  var SLAB_BYTES = 8192;
+  var SLAB_MAX_TAKE = SLAB_BYTES >>> 1;
+  var slab = null;
+  var slabUsed = 0;
+  function accumulatorBuffer(n) {
+    if (n > SLAB_MAX_TAKE) return new Uint8Array(n);
+    let s = slab;
+    if (s === null || s.length - slabUsed < n) {
+      s = slab = new Uint8Array(SLAB_BYTES);
+      slabUsed = 0;
+    }
+    const from = slabUsed;
+    slabUsed = from + n;
+    return s.subarray(from, slabUsed);
+  }
+  var ACCUMULATE = function(buffer, _start, end, needed = 0) {
+    const used = this.bytesUsed;
+    const window = needed > MIN_WINDOW ? needed : MIN_WINDOW;
+    if (buffer.length - end >= window) {
+      this.setBuffer(buffer, end, used);
+      return;
+    }
+    let cap = buffer.length * 2;
+    const want = used + window;
+    if (cap < want) cap = want;
+    const next = accumulatorBuffer(cap);
+    next.set(buffer.subarray(end - used, end));
+    this.setBuffer(next, used, used);
+  };
+  function growingOStream(initialCapacity = DEFAULT_CAPACITY) {
+    if (!Number.isInteger(initialCapacity) || initialCapacity < 1) {
+      throw argumentError(`initial capacity ${initialCapacity} must be a positive integer`);
+    }
+    return new OStream(accumulatorBuffer(initialCapacity), 0, ACCUMULATE);
+  }
+
+  // src/decode/skip.ts
+  var SKIP = Object.freeze({});
+
   // src/decode/state.ts
-  var TWO322 = 4294967296;
+  var TWO32 = 4294967296;
+  var TYPED_CAPACITY = /* @__PURE__ */ new Map([
+    [Uint8Array, { min: 0, max: 255 }],
+    [Uint16Array, { min: 0, max: 65535 }],
+    [Uint32Array, { min: 0, max: 4294967295 }],
+    [Int8Array, { min: -128, max: 127 }],
+    [Int16Array, { min: -32768, max: 32767 }],
+    [Int32Array, { min: -2147483648, max: 2147483647 }],
+    // The 64-bit pair is the accumulator's own range on both sides, so any bound a
+    // caller can state fits: `min`/`max` here are the sentinels the fit test needs,
+    // not numbers anything is compared against (the fill writes raw halves).
+    [BigUint64Array, { min: 0, max: Number.POSITIVE_INFINITY }],
+    [BigInt64Array, { min: Number.NEGATIVE_INFINITY, max: Number.POSITIVE_INFINITY }]
+  ]);
+  function typedCapacity(ctor) {
+    if (ctor === Uint8Array) return CAP_U8;
+    if (ctor === Int8Array) return CAP_I8;
+    if (ctor === Uint16Array) return CAP_U16;
+    if (ctor === Int16Array) return CAP_I16;
+    if (ctor === Uint32Array) return CAP_U32;
+    if (ctor === Int32Array) return CAP_I32;
+    return TYPED_CAPACITY.get(ctor);
+  }
+  var CAP_U8 = TYPED_CAPACITY.get(Uint8Array);
+  var CAP_I8 = TYPED_CAPACITY.get(Int8Array);
+  var CAP_U16 = TYPED_CAPACITY.get(Uint16Array);
+  var CAP_I16 = TYPED_CAPACITY.get(Int16Array);
+  var CAP_U32 = TYPED_CAPACITY.get(Uint32Array);
+  var CAP_I32 = TYPED_CAPACITY.get(Int32Array);
+  function is64(d) {
+    return d instanceof BigUint64Array || d instanceof BigInt64Array;
+  }
   var DecoderState = class {
-    constructor(limits) {
+    constructor(visitor = SKIP) {
+      /**
+       * Depth at which the current skipped subtree was opened, or `-1` when nothing
+       * is being skipped. The scope that returned `false` from
+       * {@link Visitor.sequenceBegin} closes at this depth, and skipping ends there.
+       */
+      this.skipFrom = -1;
+      /**
+       * **No receiver cap lives here** (§6.2.1). This decoder used to hold
+       * `maxArrayCount` / `maxStringLen` / `maxBlobLen`, defaulted to the format
+       * ceilings when the caller supplied none — which is precisely the shape §6.2.1
+       * forbids: "a codec **MUST NOT** hold a limit of its own, **MUST NOT** supply a
+       * default for one it was not given, **MUST NOT** read an omitted argument as
+       * *unlimited*, and **MUST NOT** clamp to one", and "a format ceiling (§6.2)
+       * reached because no cap was stated is the **format's** bound, not a receiver
+       * cap, and a port **MUST NOT** present it as one". Reporting `LimitExceeded`
+       * against `ARRAY_MAX`/`FIXLEN_MAX` did exactly that.
+       *
+       * The caps now have **one implementation** and it is not here: generated code
+       * compares them in its own flat visitor, at `arrayBegin` / `fixlenBegin` — both
+       * of which this decoder raises at the count / length header, before a byte of
+       * payload is emitted and behind the MESSAGE_SPEC §7.3 tag test — and a wrapper
+       * array's elements, which reach no visitor callback, are capped by the
+       * `StringSeq` / `BlobSeq` collectors from bounds passed to their
+       * constructors. §6.2.1: "A port whose codec offers the check **MUST NOT** also
+       * emit it into the generated layer, and a port that enforces it in generated
+       * code **MUST NOT** ask the codec to enforce it too."
+       *
+       * The format ceilings below (`ARRAY_MAX`, `FIXLEN_MAX`, `MAX_DEPTH`, the varint
+       * bound) are *not* receiver caps and stay here: they bound what the wire may
+       * express, and exceeding one is `INVALID` (§6.2).
+       */
+      /**
+       * The id of every open sequence, indexed by the depth it was opened at, so a
+       * scope close can name the sequence it closes. Fixed size, sized from
+       * {@link MAX_DEPTH} at construction — the "fixed-size parse stack" §6.6.2
+       * allows, and the reason nothing here grows a stack per message.
+       *
+       * A plain array rather than an `Int32Array`, and the difference is 3 µs: V8
+       * keeps a typed array's bytes inside the JS heap only up to 64 bytes, so a
+       * 255-slot one is an *external* allocation — measured at ~3.1 µs on Node 24,
+       * against ~5 ns for this. That is paid per decoder, and the one-shot
+       * {@link decode} builds a decoder per message, so it was the whole cost of
+       * decoding a small one. Slots are written before they are read (a scope is
+       * opened before it closes), so the array is never read holey.
+       */
+      this.seqIds = new Array(MAX_DEPTH);
+      /** Number of nested sequences currently open — 0 at the root scope. */
+      this.depth = 0;
       this.state = 0 /* Header */;
-      this.stack = [];
-      // current field
+      /**
+       * The terminal-refusal latch: the rejection this stream was stopped by, or
+       * `null` while it is still healthy. **One latch, two codes** — §5.3.1 gives the
+       * rule one implementation, and §6.3 makes both of these rejections terminal:
+       *
+       * - `INVALID_MSG` (§5.2.1: "malformed **regardless of what follows** … no —
+       *   terminal") — no later bytes can make malformed input valid;
+       * - `LIMIT_EXCEEDED` (§6.3: "A **terminal**, receiver-local **policy**
+       *   rejection") — well-formed bytes the receiver's cap refuses.
+       *
+       * They are latched together and **kept apart by their code**, which is the
+       * distinction §6.3 requires: a limit rejection "**MUST NOT** be reported as
+       * `InvalidMessage`", so the code is re-raised as itself and each stays the
+       * refusal it was.
+       *
+       * Latching is not bookkeeping, it is the terminality: both rejections are
+       * raised *mid-field* — the UTF-8 check inside a payload piece, a cap inside the
+       * count or length callback — so the machine is left at a position the visitor
+       * never finished. Resume it and the refused field's own bytes are re-read as
+       * headers, delivering fields that were never on the wire.
+       *
+       * The rejection is written here by {@link latch} and nowhere else: this
+       * machine's own malformation findings arrive through {@link fail}, and the ones
+       * raised above it — the §6.4.5 UTF-8 verdict, and the receiver caps §6.2.1
+       * keeps out of this codec — arrive as a throw out of a visitor callback, caught
+       * once in {@link push}.
+       */
+      this.refusal = null;
+      /**
+       * A `DataView` over the chunk currently being fed, and the chunk it addresses —
+       * the **language-forced handle** of CORELIB_PLAN §6.6.2, and the only way
+       * JavaScript lets a reader take an IEEE-754 value from a byte offset. Without it
+       * a float costs four or eight byte loads, a shift ladder and a round trip
+       * through a scratch word; with it, one call.
+       *
+       * It qualifies because it carries no message bytes (it addresses the *caller's*
+       * chunk) and no wire number sizes it (its extent is the chunk's). Built lazily
+       * and only where it pays: a float **array** whose remaining run inside this chunk
+       * clears {@link FP32_HANDLE_MIN} / {@link FP64_HANDLE_MIN}. A scalar float, a
+       * short array, a message with no float at all, and a byte-at-a-time feed each
+       * build none. Once built it is kept while the same chunk is being fed, and it
+       * never leaves this class.
+       */
+      this.view = null;
+      this.viewOf = null;
+      /** The current field's id. */
       this.id = 0;
-      // Resumable varint accumulator, as two unsigned 32-bit halves (vLo / vHi)
-      // plus the byte count so far. Number-only: a `bigint` is built once, at the
-      // end, and only for full 64-bit *values* (not ids, lengths or counts).
+      // Resumable varint accumulator, as two unsigned 32-bit halves (vLo / vHi) plus
+      // the byte count so far. Number-only: a `bigint` is built once, at the end, and
+      // only for full 64-bit *values* (never for ids, lengths or counts).
       this.vLo = 0;
       this.vHi = 0;
       this.vBytes = 0;
       this.vComplete = false;
-      // fixlen / fp scratch
-      this.scratch = new Uint8Array(8);
+      /**
+       * Resumable fp32 / fp64 accumulator, as two little-endian 32-bit words rather
+       * than a byte array: a typed array would be a per-decoder allocation, and two
+       * number fields hold the same 8 bytes. Byte `k` lands in bits `8*k` of `fpLo`
+       * (k < 4) or of `fpHi`, so the pair is already in wire (little-endian) order.
+       */
+      this.fpLo = 0;
+      this.fpHi = 0;
       this.need = 0;
       this.have = 0;
       // fixlen string/blob streaming
@@ -1183,98 +1828,249 @@ var SofaBuffers = (function (exports) {
       this.arrIsFixlen = false;
       this.arrCount = 0;
       this.arrIndex = 0;
-      this.maxArrayCount = limits?.maxArrayCount ?? Infinity;
-      this.maxStringLen = limits?.maxStringLen ?? Infinity;
-      this.maxBlobLen = limits?.maxBlobLen ?? Infinity;
+      /**
+       * The destination the visitor handed over for the array being decoded, or
+       * `null` while no hand-off is in force — which is every array the visitor
+       * declined, and every array at all for a visitor that declares no
+       * {@link Visitor.arrayBulk}.
+       *
+       * **The one reference this machine keeps into the caller's storage between
+       * `feed` calls.** Everything else it holds past a callback is its own (§6.6):
+       * a payload is reported as coordinates into the caller's chunk and never
+       * retained. An array that straddles chunks has to remember where its elements
+       * go, so this lives from the hand-off to `arrayEnd` — and is dropped there,
+       * by {@link endArray}, and by {@link release} for a machine going back to the
+       * pool.
+       */
+      this.bulk = null;
+      /** Which destination {@link bulk} named; meaningless while it is `null`. */
+      this.bulkMode = 0 /* Values */;
+      /**
+       * The `Uint32Array` over a 64-bit typed destination (see {@link BM.Typed64}),
+       * or over an `f32` destination once it has taken a NaN (see {@link f32StoreWord}).
+       */
+      this.bulk64 = null;
+      this.root = visitor;
+      this.cur = visitor;
+      this.begin(visitor);
     }
-    /** Feed `input` to the machine, dispatching to `root` and its sub-visitors. */
-    push(input, root) {
-      if (this.stack.length === 0) this.stack.push(root);
-      let i = 0;
+    /**
+     * (Re)bind this machine to a visitor, clearing every trace of whatever it
+     * decoded before.
+     *
+     * Constructing a decoder is the one allocating step (§6.6), and the one-shot
+     * {@link decode} would otherwise pay it per message — which on a 37-byte message
+     * is most of the cost. So {@link decode} keeps one machine and re-binds it here;
+     * this method is what makes that indistinguishable from a fresh one.
+     *
+     * **Only the fields a fresh decode can *read* are cleared**, and the list is
+     * exhaustive by construction rather than by inspection: every other field is
+     * written before it is read, on every path that reads it — `id` at each header,
+     * `vLo`/`vHi` by whichever varint reader ran (a fresh accumulation starts from
+     * zero because `vBytes` is 0), `vComplete` by the `varintStep` whose result is
+     * being tested, `fpLo`/`fpHi`/`need` by {@link fpBegin}, `fix*` by
+     * {@link fixlenWord}, `arrKind`/`arrIsFixlen` by {@link dispatch} and
+     * `arrCount`/`arrIndex` by the count word and `bulkMode` by the hand-off the
+     * same word makes (`bulk` *is* cleared: it is the caller's storage, and a
+     * machine that starts a fresh decode must not still be pointing at the last
+     * one's), `seqIds[d]` when the scope at `d`
+     * opens. `have` is the one exception and *is* cleared: the `S.ArrayFp` bulk loop
+     * reads it to decide whether an element is half-arrived.
+     *
+     * `view`/`viewOf` are not cleared either, and deliberately: {@link dataView}
+     * keys the cached handle on the chunk it addresses, so a stale one is rebuilt the
+     * moment a different chunk arrives and reused — correctly — when the same buffer
+     * is decoded again. {@link release} still drops it, which is where it matters:
+     * a pooled machine must not keep the caller's last chunk alive between calls.
+     *
+     * Clearing them all anyway cost 5573 → 5324 Ir/op on `decode: typical message`
+     * (~4.5%), which is what a 21-field wipe costs when the message is 37 bytes. The
+     * invariant is held by `pooled-decoder-state.test.ts`, which aborts a decode in
+     * every construct and then reuses the machine.
+     */
+    begin(visitor) {
+      this.root = visitor;
+      this.cur = visitor;
+      this.skipFrom = -1;
+      this.depth = 0;
+      this.state = 0 /* Header */;
+      this.refusal = null;
+      this.vBytes = 0;
+      this.have = 0;
+      this.bulk = null;
+      this.bulk64 = null;
+    }
+    /**
+     * Drop the references a pooled machine would otherwise keep alive: the caller's
+     * visitor, and the handle onto the caller's chunk.
+     */
+    release() {
+      this.root = SKIP;
+      this.cur = SKIP;
+      this.view = null;
+      this.viewOf = null;
+      this.bulk = null;
+      this.bulk64 = null;
+    }
+    /** Feed `input` to the machine, dispatching to the bound visitor. */
+    push(input) {
+      const latched = this.refusal;
+      if (latched !== null) throw new SofabError(latched.code, latched.message);
+      try {
+        this.run(input);
+      } catch (e) {
+        if (this.refusal === null && e instanceof SofabError && (e.code === SofabErrorCode.InvalidMsg || e.code === SofabErrorCode.LimitExceeded || e.code === SofabErrorCode.Argument)) {
+          this.latch(e);
+        }
+        throw e;
+      }
+    }
+    /**
+     * The decode loop itself. {@link push} wraps it, so the terminal-refusal latch
+     * is applied in exactly one place — including to a rejection the visitor raised
+     * — and this stays the plain state machine.
+     */
+    run(input) {
       const n = input.length;
+      let i = 0;
       while (i < n) {
+        if (this.state === 0 /* Header */ && this.vBytes === 0) {
+          let h;
+          const hb = input[i];
+          if (hb < 128) {
+            this.vLo = hb;
+            this.vHi = 0;
+            h = i + 1;
+          } else h = this.varintQuick(input, i, n);
+          if (h >= 0) {
+            i = h;
+            const type = this.vLo & 7;
+            const id = this.vHi === 0 ? this.vLo >>> 3 : this.vUpper();
+            if (id > ID_MAX) this.fail(`field id ${id} out of range`);
+            if (type === WireType.SequenceEnd) {
+              this.endSequence();
+              continue;
+            }
+            this.id = id;
+            this.cur.fieldBegin?.(id, type);
+            if (type === WireType.Unsigned) {
+              let v;
+              const b0 = i < n ? input[i] : 128;
+              if (b0 < 128) {
+                this.vLo = b0;
+                this.vHi = 0;
+                v = i + 1;
+              } else v = this.varintQuick(input, i, n);
+              if (v < 0) {
+                this.state = 1 /* ScalarU */;
+                continue;
+              }
+              i = v;
+              const lo = this.vLo >>> 0;
+              const hi = this.vHi >>> 0;
+              this.cur.unsigned?.(
+                id,
+                hi <= 2097151 ? hi * TWO32 + lo : joinU64(lo, hi),
+                lo,
+                hi
+              );
+              continue;
+            }
+            if (type === WireType.Signed) {
+              let v;
+              const b0 = i < n ? input[i] : 128;
+              if (b0 < 128) {
+                this.vLo = b0;
+                this.vHi = 0;
+                v = i + 1;
+              } else v = this.varintQuick(input, i, n);
+              if (v < 0) {
+                this.state = 2 /* ScalarS */;
+                continue;
+              }
+              i = v;
+              const lo = this.vLo >>> 0;
+              const hi = this.vHi >>> 0;
+              const mask = -(lo & 1) >>> 0;
+              this.cur.signed?.(
+                id,
+                this.vSigned(),
+                ((lo >>> 1 | hi << 31) >>> 0 ^ mask) >>> 0,
+                (hi >>> 1 ^ mask) >>> 0
+              );
+              continue;
+            }
+            if (type === WireType.Fixlen) {
+              const w = this.varintQuick(input, i, n);
+              if (w < 0) {
+                this.state = 3 /* FixlenWord */;
+                continue;
+              }
+              i = this.fixlenWord(input, w, n);
+              continue;
+            }
+            this.dispatch(type);
+            continue;
+          }
+        }
         switch (this.state) {
           case 0 /* Header */: {
             i = this.varintStep(input, i);
             if (!this.vComplete) return;
-            const type = this.vTag();
+            const type = this.vLo & 7;
+            const id = this.vUpper();
+            if (id > ID_MAX) this.fail(`field id ${id} out of range`);
             if (type === WireType.SequenceEnd) {
-              this.resetVarint();
               this.endSequence();
               break;
             }
-            const id = this.vUpper();
-            this.resetVarint();
-            if (id > ID_MAX) throw invalidMsgError(`field id ${id} out of range`);
             this.id = id;
+            this.cur.fieldBegin?.(id, type);
             this.dispatch(type);
             break;
           }
           case 1 /* ScalarU */: {
             i = this.varintStep(input, i);
             if (!this.vComplete) return;
-            const value = this.vUnsigned();
-            this.resetVarint();
-            this.top().unsigned?.(this.id, value);
             this.state = 0 /* Header */;
+            this.cur.unsigned?.(this.id, this.vUnsigned(), this.vLo >>> 0, this.vHi >>> 0);
             break;
           }
           case 2 /* ScalarS */: {
             i = this.varintStep(input, i);
             if (!this.vComplete) return;
-            const value = this.vSigned();
-            this.resetVarint();
-            this.top().signed?.(this.id, value);
             this.state = 0 /* Header */;
+            const lo = this.vLo >>> 0;
+            const hi = this.vHi >>> 0;
+            const mask = -(lo & 1) >>> 0;
+            this.cur.signed?.(
+              this.id,
+              this.vSigned(),
+              ((lo >>> 1 | hi << 31) >>> 0 ^ mask) >>> 0,
+              (hi >>> 1 ^ mask) >>> 0
+            );
             break;
           }
-          case 3 /* FixlenLen */: {
+          case 3 /* FixlenWord */: {
             i = this.varintStep(input, i);
             if (!this.vComplete) return;
-            const sub = this.vTag();
-            const len = this.vUpper();
-            this.resetVarint();
-            if (sub > FixlenSubtype.Blob) throw invalidMsgError(`invalid fixlen subtype ${sub}`);
-            if (len > FIXLEN_MAX) throw invalidMsgError("fixlen length out of range");
-            if (sub === FixlenSubtype.String && len > this.maxStringLen) {
-              throw limitExceededError(`string length ${len} exceeds maxStringLen ${this.maxStringLen}`);
-            }
-            if (sub === FixlenSubtype.Blob && len > this.maxBlobLen) {
-              throw limitExceededError(`blob length ${len} exceeds maxBlobLen ${this.maxBlobLen}`);
-            }
-            this.fixSub = sub;
-            this.fixLen = len;
-            this.fixOff = 0;
-            if (sub === FixlenSubtype.Fp32 || sub === FixlenSubtype.Fp64) {
-              const want = sub === FixlenSubtype.Fp32 ? 4 : 8;
-              if (this.fixLen !== want) throw invalidMsgError("fixlen float length mismatch");
-              this.need = want;
-              this.have = 0;
-              this.state = 4 /* FixlenFp */;
-            } else {
-              if (this.fixLen === 0) {
-                this.emitBytes(input.subarray(0, 0));
-                this.state = 0 /* Header */;
-              } else {
-                this.state = 5 /* FixlenBytes */;
-              }
-            }
+            i = this.fixlenWord(input, i, n);
             break;
           }
           case 4 /* FixlenFp */: {
-            i = this.fpStep(input, i);
+            i = this.fpStep(input, i, n);
             if (this.have < this.need) return;
-            const value = this.fixSub === FixlenSubtype.Fp32 ? unpackFp32(this.scratch, 0) : unpackFp64(this.scratch, 0);
-            if (this.fixSub === FixlenSubtype.Fp32) {
-              const top = this.top();
-              top.fp32?.(this.id, value, top.fp32Raw ? this.scratch.subarray(0, 4) : void 0);
-            } else this.top().fp64?.(this.id, value);
             this.state = 0 /* Header */;
+            if (this.fixSub === FixlenSubtype.Fp32) {
+              this.cur.fp32?.(this.id, fp32FromBits(this.fpLo), this.fpLo >>> 0);
+            } else {
+              this.cur.fp64?.(this.id, fp64FromBits(this.fpLo, this.fpHi));
+            }
             break;
           }
           case 5 /* FixlenBytes */: {
             const take = Math.min(n - i, this.fixLen - this.fixOff);
-            this.emitBytes(input.subarray(i, i + take));
+            this.emitBytes(input, i, i + take);
             i += take;
             this.fixOff += take;
             if (this.fixOff === this.fixLen) this.state = 0 /* Header */;
@@ -1284,77 +2080,95 @@ var SofaBuffers = (function (exports) {
             i = this.varintStep(input, i);
             if (!this.vComplete) return;
             const count = this.vNum();
-            this.resetVarint();
-            if (count > ARRAY_MAX) throw invalidMsgError("array count out of range");
-            if (count > this.maxArrayCount) {
-              throw limitExceededError(`array count ${count} exceeds maxArrayCount ${this.maxArrayCount}`);
-            }
+            if (count > ARRAY_MAX) this.fail("array count out of range");
             this.arrCount = count;
             this.arrIndex = 0;
             if (this.arrIsFixlen) {
-              this.state = 9 /* ArrayElemLen */;
+              this.state = 8 /* ArrayElemWord */;
             } else if (count === 0) {
-              this.top().arrayBegin?.(this.id, this.arrKind, 0);
-              this.top().arrayEnd?.(this.id);
-              this.state = 0 /* Header */;
+              this.cur.arrayBegin?.(this.id, this.arrKind, 0);
+              this.askBulk(this.arrKind, 0);
+              this.endArray();
             } else {
-              this.top().arrayBegin?.(this.id, this.arrKind, this.arrCount);
-              this.state = this.arrKind === ArrayKind.Unsigned ? 7 /* ArrayUElem */ : 8 /* ArraySElem */;
+              this.state = 7 /* ArrayElem */;
+              this.cur.arrayBegin?.(this.id, this.arrKind, count);
+              this.askBulk(this.arrKind, count);
             }
             break;
           }
-          case 7 /* ArrayUElem */: {
-            i = this.varintStep(input, i);
-            if (!this.vComplete) return;
-            const value = this.vUnsigned();
-            this.resetVarint();
-            this.top().arrayUnsigned?.(this.id, this.arrIndex, value);
-            this.advanceArray();
-            break;
-          }
-          case 8 /* ArraySElem */: {
+          case 7 /* ArrayElem */: {
+            const count = this.arrCount;
+            const safeEnd = n - VARINT_MAX_BYTES;
+            if (this.bulk !== null) {
+              i = this.arrKind === ArrayKind.Unsigned ? this.uBulkArm(input, i, n, count, safeEnd) : this.sBulkArm(input, i, n, count, safeEnd);
+              break;
+            }
+            let idx = this.arrIndex;
+            if (this.vBytes === 0) {
+              while (idx < count && i <= safeEnd) {
+                i = this.varintFull(input, i);
+                idx++;
+              }
+              this.arrIndex = idx;
+            }
+            if (idx === count) {
+              this.state = 0 /* Header */;
+              this.cur.arrayEnd?.(this.id);
+              break;
+            }
+            if (i >= n) break;
             i = this.varintStep(input, i);
             if (!this.vComplete) return;
-            const value = this.vSigned();
-            this.resetVarint();
-            this.top().arraySigned?.(this.id, this.arrIndex, value);
             this.advanceArray();
             break;
           }
-          case 9 /* ArrayElemLen */: {
+          case 8 /* ArrayElemWord */: {
             i = this.varintStep(input, i);
             if (!this.vComplete) return;
-            const sub = this.vTag();
+            const sub = this.vLo & 7;
             const size = this.vUpper();
-            this.resetVarint();
             if (sub === FixlenSubtype.Fp32 && size === 4) {
               this.arrKind = ArrayKind.Fp32;
-              this.need = 4;
+              this.fpBegin(4);
             } else if (sub === FixlenSubtype.Fp64 && size === 8) {
               this.arrKind = ArrayKind.Fp64;
-              this.need = 8;
+              this.fpBegin(8);
             } else {
-              throw invalidMsgError("invalid fixlen array element type");
+              this.fail("invalid fixlen array element type");
             }
-            this.top().arrayBegin?.(this.id, this.arrKind, this.arrCount);
             if (this.arrCount === 0) {
-              this.top().arrayEnd?.(this.id);
-              this.state = 0 /* Header */;
+              this.cur.arrayBegin?.(this.id, this.arrKind, 0);
+              this.askBulk(this.arrKind, 0);
+              this.endArray();
             } else {
-              this.have = 0;
-              this.state = 10 /* ArrayFp */;
+              this.state = 9 /* ArrayFp */;
+              this.cur.arrayBegin?.(this.id, this.arrKind, this.arrCount);
+              this.askBulk(this.arrKind, this.arrCount);
             }
             break;
           }
-          case 10 /* ArrayFp */: {
-            i = this.fpStep(input, i);
+          case 9 /* ArrayFp */: {
+            const count = this.arrCount;
+            const size = this.need;
+            if (this.bulk !== null) {
+              const is32 = this.arrKind === ArrayKind.Fp32;
+              i = this.fpBulkArm(input, i, n, count, size, is32);
+              break;
+            }
+            if (this.have === 0) {
+              const run = Math.min(count - this.arrIndex, (n - i) / size | 0);
+              i += run * size;
+              this.arrIndex += run;
+            }
+            if (this.arrIndex === count) {
+              this.state = 0 /* Header */;
+              this.cur.arrayEnd?.(this.id);
+              break;
+            }
+            if (i >= n) break;
+            i = this.fpStep(input, i, n);
             if (this.have < this.need) return;
-            const value = this.arrKind === ArrayKind.Fp32 ? unpackFp32(this.scratch, 0) : unpackFp64(this.scratch, 0);
-            if (this.arrKind === ArrayKind.Fp32) {
-              const top = this.top();
-              top.arrayFp32?.(this.id, this.arrIndex, value, top.fp32Raw ? this.scratch.subarray(0, 4) : void 0);
-            } else this.top().arrayFp64?.(this.id, this.arrIndex, value);
-            this.have = 0;
+            this.fpBegin(size);
             this.advanceArray();
             break;
           }
@@ -1362,20 +2176,104 @@ var SofaBuffers = (function (exports) {
       }
     }
     /**
-     * Report the terminal decode outcome (MESSAGE_SPEC §7) *without* promoting it
-     * to an error. Returns {@link DecodeStatus.Complete} when the stream ended
-     * exactly at a field boundary, or {@link DecodeStatus.Incomplete} when it
-     * ended inside a field (a partial varint, an unfinished payload / array, or a
-     * still-open nested sequence). This is a pure accessor — the finish-less spec
-     * has no finalize step, and a trailing `Incomplete` is a truncation the caller
-     * decides how to treat, not an error this machine raises. A genuinely
-     * malformed message has already thrown from {@link push}.
+     * Where the decode stands (§5.2.1), *without* promoting it to an error:
+     * {@link DecodeStatus.Complete} when the stream ended exactly at a field
+     * boundary, {@link DecodeStatus.Incomplete} when it ended inside a field (a
+     * partial varint, an unfinished payload / array, or a still-open nested
+     * sequence). A trailing `Incomplete` is a truncation the caller decides how to
+     * treat (§5.2.4), not an error this machine raises.
+     *
+     * **Only these two, and only on a healthy machine.** This is read in exactly
+     * one place — after a {@link push} that returned — and a push that met a
+     * terminal refusal does not return: it throws, this call is never reached, and
+     * the verdict travels out on the error it threw. So `Invalid` is not a value
+     * this can produce, and neither is the "refused by a cap" state the outcome
+     * triple cannot name (§6.3). Nothing here re-reports a latched refusal, because
+     * nothing needs to: the throw is the whole report, and a report with one
+     * carrier has nothing to drift out of step with.
+     *
+     * The cursor's own answer would be wrong for a refused stream, which is why the
+     * refusal must not fall through to it: a cap is compared in `arrayBegin` /
+     * `fixlenBegin`, raised with the header and the count / length word consumed and
+     * the payload not yet entered — a cursor that reads as a clean field boundary,
+     * and so as `Complete`. {@link push}'s latch is what keeps that unreachable.
      */
-    finish() {
-      const atBoundary = this.state === 0 /* Header */ && this.vBytes === 0 && this.stack.length <= 1;
+    outcome() {
+      const atBoundary = this.state === 0 /* Header */ && this.vBytes === 0 && this.depth === 0;
       return atBoundary ? DecodeStatus.Complete : DecodeStatus.Incomplete;
     }
     // --- helpers ------------------------------------------------------------
+    /**
+     * Reject the input as malformed: latch the terminal `INVALID` verdict and throw
+     * `INVALID_MSG`. Every malformation *this machine* finds goes through here, so
+     * none of them can be caught and then decoded past — §5.2.1's "no — terminal".
+     * Declared `never` so a call ends control flow exactly like the `throw` it
+     * replaced.
+     */
+    fail(message) {
+      throw this.latch(invalidMsgError(message));
+    }
+    /**
+     * Record `e` as the terminal refusal that stopped this stream, and hand it back
+     * to be thrown. The only writer of {@link refusal} — §5.3.1's one
+     * implementation of the rule — for a rejection raised here and for one raised
+     * above this machine and caught in {@link push} alike. The error is stored, not
+     * its text: the code travels with it, so `INVALID_MSG` and `LIMIT_EXCEEDED`
+     * each stay themselves (§6.3).
+     */
+    latch(e) {
+      this.refusal = e;
+      this.bulk = null;
+      this.bulk64 = null;
+      return e;
+    }
+    /**
+     * Act on a complete `fixlen_word` sitting in the varint accumulator: validate
+     * it, announce the field, and either read the float inline (when its bytes are
+     * in this chunk) or set up the resumable payload state. Shared by the fast lane
+     * and the `S.FixlenWord` arm, so the §4.6 rules exist once.
+     */
+    fixlenWord(input, i, n) {
+      const sub = this.vLo & 7;
+      const len = this.vUpper();
+      if (sub > FixlenSubtype.Blob) this.fail(`invalid fixlen subtype ${sub}`);
+      if (len > FIXLEN_MAX) this.fail("fixlen length out of range");
+      if (sub === FixlenSubtype.Fp32 || sub === FixlenSubtype.Fp64) {
+        const want = sub === FixlenSubtype.Fp32 ? 4 : 8;
+        if (len !== want) this.fail("fixlen float length mismatch");
+        this.fixSub = sub;
+        if (n - i >= want) {
+          this.state = 0 /* Header */;
+          const lo = u32le(input, i);
+          if (want === 4) {
+            this.cur.fp32?.(this.id, fp32FromBits(lo), lo);
+          } else {
+            this.cur.fp64?.(this.id, fp64FromBits(lo, u32le(input, i + 4)));
+          }
+          return i + want;
+        }
+        this.fpBegin(want);
+        this.state = 4 /* FixlenFp */;
+        return i;
+      }
+      this.fixSub = sub;
+      this.fixLen = len;
+      this.fixOff = 0;
+      this.cur.fixlenBegin?.(this.id, this.fixSub, len);
+      if (len === 0) {
+        this.emitBytes(input, i, i);
+        this.state = 0 /* Header */;
+        return i;
+      }
+      const take = Math.min(n - i, len);
+      if (take > 0) {
+        this.emitBytes(input, i, i + take);
+        this.fixOff = take;
+        i += take;
+      }
+      this.state = this.fixOff === len ? 0 /* Header */ : 5 /* FixlenBytes */;
+      return i;
+    }
     dispatch(type) {
       switch (type) {
         case WireType.Unsigned:
@@ -1385,7 +2283,7 @@ var SofaBuffers = (function (exports) {
           this.state = 2 /* ScalarS */;
           break;
         case WireType.Fixlen:
-          this.state = 3 /* FixlenLen */;
+          this.state = 3 /* FixlenWord */;
           break;
         case WireType.ArrayUnsigned:
           this.arrKind = ArrayKind.Unsigned;
@@ -1401,778 +2299,1293 @@ var SofaBuffers = (function (exports) {
           this.arrIsFixlen = true;
           this.state = 6 /* ArrayCount */;
           break;
-        case WireType.SequenceStart: {
-          if (this.stack.length - 1 >= MAX_DEPTH) {
-            throw invalidMsgError(`nesting exceeds MAX_DEPTH (${MAX_DEPTH})`);
-          }
-          const child = this.top().sequenceBegin?.(this.id);
-          this.stack.push(child ?? this.top());
-          this.state = 0 /* Header */;
+        case WireType.SequenceStart:
+          this.beginSequence();
           break;
-        }
         default:
-          throw invalidMsgError(`invalid wire type ${type}`);
+          this.fail(`invalid wire type ${type}`);
+      }
+    }
+    /**
+     * Open a nested sequence: offer it to the visitor, note its id, and descend.
+     *
+     * A visitor that answers `false` declines the whole subtree — no callback of
+     * any kind fires inside it, its own {@link Visitor.sequenceEnd} included, and a
+     * scope opened within it is never offered either. The subtree is still *parsed*
+     * (a sequence is framed by markers, not by a length, so its end has to be
+     * found) and every format ceiling still applies; what stops is delivery.
+     */
+    beginSequence() {
+      const d = this.depth;
+      if (d >= MAX_DEPTH) this.fail(`nesting exceeds MAX_DEPTH (${MAX_DEPTH})`);
+      if (this.cur !== SKIP && this.root.sequenceBegin?.(this.id, d + 1) === false) {
+        this.skipFrom = d;
+        this.cur = SKIP;
       }
+      this.seqIds[d] = this.id;
+      this.depth = d + 1;
+      this.state = 0 /* Header */;
     }
     endSequence() {
-      if (this.stack.length <= 1) throw invalidMsgError("unbalanced sequence end");
-      this.top().sequenceEnd?.();
-      this.stack.pop();
+      const d = this.depth;
+      if (d === 0) this.fail("unbalanced sequence end");
       this.state = 0 /* Header */;
+      const closed = d - 1;
+      this.depth = closed;
+      if (this.skipFrom >= 0) {
+        if (this.skipFrom === closed) {
+          this.skipFrom = -1;
+          this.cur = this.root;
+        }
+        return;
+      }
+      this.root.sequenceEnd?.(this.seqIds[closed], d);
     }
     advanceArray() {
-      this.arrIndex++;
-      if (this.arrIndex === this.arrCount) {
-        this.top().arrayEnd?.(this.id);
+      if (++this.arrIndex === this.arrCount) {
         this.state = 0 /* Header */;
+        this.cur.arrayEnd?.(this.id);
       }
     }
-    emitBytes(chunk) {
-      const v = this.top();
-      if (this.fixSub === FixlenSubtype.String) v.string?.(this.id, this.fixLen, this.fixOff, chunk);
-      else v.blob?.(this.id, this.fixLen, this.fixOff, chunk);
+    /**
+     * Close an array delivered through the hand-off: back to the header state, drop
+     * the visitor's destination, announce the end. Every bulk array ends here, so
+     * the reference into the caller's storage cannot outlive the array it was made
+     * for (§6.6; see {@link bulk}).
+     *
+     * The per-element arms keep their own two lines instead of calling this: they
+     * can never hold a destination — the hand-off's arms have already taken over
+     * before they run — and the call showed up on `decode: typical`.
+     */
+    endArray() {
+      this.state = 0 /* Header */;
+      const t = this.bulk;
+      if (t !== null) this.trimPlain(t, this.arrIndex);
+      this.bulk = null;
+      this.bulk64 = null;
+      this.cur.arrayEnd?.(this.id);
+    }
+    /**
+     * Cut a plain-array destination to the `written` elements this array actually
+     * put in it, so a destination reused across arrays — the shape the hand-off
+     * exists for — can never hand back the previous array's tail, and its `length`
+     * always means "elements of *this* array".
+     *
+     * At the end rather than at the hand-off, and that is measured: clearing it up
+     * front turns every element write into a grow (`array<u16>` 181 583 -> 231 815
+     * Ir/op, worse than the per-element path it replaces), where one length store
+     * per array costs nothing. A pre-sized destination — the fast shape, every write
+     * in bounds — is left exactly as it was.
+     *
+     * The typed destinations are not trimmed and cannot be: their length is the
+     * caller's allocation, checked against `count` at the hand-off, and `count` is
+     * how far this fill wrote.
+     */
+    trimPlain(t, written) {
+      const mode = this.bulkMode;
+      if (mode !== 0 /* Values */ && mode !== 1 /* Values32 */ && mode !== 5 /* Longs */) return;
+      const out = mode === 5 /* Longs */ ? t.longs : t.values;
+      if (out.length > written) out.length = written;
     }
-    top() {
-      return this.stack[this.stack.length - 1];
+    /**
+     * Offer the bulk hand-off for the array that just began, and resolve the answer
+     * once (CORELIB_PLAN §5.3.1's one implementation, and {@link ArrayTarget}'s
+     * contract): after this, the element loops know which destination to write to
+     * from {@link bulkMode} and re-decide nothing per element.
+     *
+     * Raised after `arrayBegin` and before the first element, so a receiver cap on
+     * the count (§6.2.1) is still compared in `arrayBegin` and a rejected array is
+     * never offered. A visitor that declares no `arrayBulk` pays one short-circuited
+     * optional call per array.
+     *
+     * **An empty array is offered too**, with `count` of 0. There is nothing to
+     * write, but there is something to say: a destination held across fields would
+     * otherwise still be holding the last array's elements, and its length is the
+     * only place this one's emptiness could show up (see {@link trimPlain}).
+     */
+    askBulk(kind, count) {
+      const t = this.cur.arrayBulk?.(this.id, kind, count) ?? null;
+      if (t === null) {
+        this.bulk = null;
+        this.bulk64 = null;
+        return;
+      }
+      this.bulk64 = null;
+      this.bulkMode = this.resolveTarget(t, kind, count);
+      this.bulk = t;
     }
     /**
-     * Consume varint bytes from `input` at `i` into the {@link vLo} / {@link vHi}
-     * accumulator, resuming across chunk boundaries; sets {@link vComplete} when a
-     * terminator byte arrives. Number-only — no per-byte `bigint`.
+     * Which destination `t` names — or an `Argument` refusal if it names none, more
+     * than one, one that contradicts the array's element kind, or one too short to
+     * hold `count` elements.
+     *
+     * These are caller mistakes rather than message verdicts, so they are
+     * `InvalidArgument` (§6.3) and not `INVALID_MSG`: the same bytes decode fine for
+     * a visitor that hands over a destination it can actually fill. Checked once per
+     * array, which is why the fill loops need no guard of their own.
      */
-    varintStep(input, i) {
-      let lo = this.vLo;
-      let hi = this.vHi;
-      let k = this.vBytes;
-      const n = input.length;
-      while (i < n) {
-        if (k >= VARINT_MAX_BYTES) throw invalidMsgError("varint overflow");
-        const b = input[i++];
-        if (k < 4) lo |= (b & 127) << 7 * k;
-        else if (k === 4) {
-          lo |= (b & 15) << 28;
-          hi |= b >> 4 & 7;
-        } else {
-          if (k === 9 && (b & 127) >> 1 !== 0) throw invalidMsgError("varint overflow");
-          hi |= (b & 127) << 7 * k - 32;
+    resolveTarget(t, kind, count) {
+      if (kind === ArrayKind.Fp32 || kind === ArrayKind.Fp64) {
+        const f = t;
+        const is32 = kind === ArrayKind.Fp32;
+        const dest = is32 ? f.f32 ?? f.bits : f.f64;
+        const named2 = (f.f32 !== void 0 ? 1 : 0) + (f.bits !== void 0 ? 1 : 0) + (f.f64 !== void 0 ? 1 : 0) + (t.bool !== void 0 ? 1 : 0);
+        const want = is32 ? "f32 or bits" : "f64";
+        if (dest === void 0 || named2 !== 1) {
+          throw argumentError(
+            `array ${this.id}: an ${is32 ? "fp32" : "fp64"} array needs exactly the ${want} destination`
+          );
         }
-        k++;
-        if ((b & 128) === 0) {
-          this.vLo = lo;
-          this.vHi = hi;
-          this.vBytes = k;
-          this.vComplete = true;
-          return i;
+        if (dest.length < count) {
+          throw argumentError(
+            `array ${this.id}: ${is32 ? "fp32" : "fp64"} destination holds ${dest.length} of ${count} elements`
+          );
         }
+        if (!is32) return 9 /* F64 */;
+        return f.bits !== void 0 ? 8 /* F32Bits */ : 7 /* F32 */;
       }
-      this.vLo = lo;
-      this.vHi = hi;
-      this.vBytes = k;
-      this.vComplete = false;
-      return i;
+      const bt = t;
+      if (bt.bool !== void 0) {
+        const other = t;
+        const float = t;
+        if (other.values !== void 0 || other.longs !== void 0 || other.typed !== void 0 || other.lo !== void 0 || other.hi !== void 0 || float.f32 !== void 0 || float.bits !== void 0 || float.f64 !== void 0) {
+          throw argumentError(`array ${this.id}: an array target needs exactly one destination`);
+        }
+        if (kind !== ArrayKind.Unsigned) {
+          throw argumentError(`array ${this.id}: a bool destination needs an unsigned array`);
+        }
+        if (bt.bool.length < count) {
+          throw argumentError(
+            `array ${this.id}: bool destination holds ${bt.bool.length} of ${count} elements`
+          );
+        }
+        return 4 /* Bool */;
+      }
+      const it = t;
+      const halves = it.lo !== void 0 || it.hi !== void 0;
+      const named = (it.values !== void 0 ? 1 : 0) + (it.longs !== void 0 ? 1 : 0) + (it.typed !== void 0 ? 1 : 0) + (halves ? 1 : 0);
+      if (named !== 1) {
+        throw argumentError(
+          `array ${this.id}: an integer array target needs exactly one destination (values, typed, longs, or lo+hi), got ${named}`
+        );
+      }
+      if (it.minLo >>> 0 !== it.minLo || it.minHi >>> 0 !== it.minHi || it.maxLo >>> 0 !== it.maxLo || it.maxHi >>> 0 !== it.maxHi) {
+        throw argumentError(
+          `array ${this.id}: the element bound must be four unsigned 32-bit halves`
+        );
+      }
+      const signed = kind === ArrayKind.Signed;
+      const minHi = signed ? it.minHi | 0 : it.minHi;
+      const maxHi = signed ? it.maxHi | 0 : it.maxHi;
+      if (minHi > maxHi || minHi === maxHi && it.minLo > it.maxLo) {
+        throw argumentError(
+          `array ${this.id}: the element bound is empty (min ${it.minHi}:${it.minLo} > max ${it.maxHi}:${it.maxLo})`
+        );
+      }
+      if (it.typed !== void 0) {
+        return kind === ArrayKind.Signed ? this.typedModeS(it, it.typed, kind, count) : this.typedModeU(it, it.typed, kind, count);
+      }
+      if (halves) {
+        const lo = it.lo;
+        const hi = it.hi;
+        if (lo === void 0 || hi === void 0) {
+          throw argumentError(`array ${this.id}: the halves destination needs both lo and hi`);
+        }
+        if (lo.length < count || hi.length < count) {
+          throw argumentError(
+            `array ${this.id}: halves destination holds ${Math.min(lo.length, hi.length)} of ${count} elements`
+          );
+        }
+        return 6 /* Halves */;
+      }
+      if (it.longs !== void 0) {
+        if (!Array.isArray(it.longs)) {
+          throw argumentError(`array ${this.id}: the longs destination must be an Array`);
+        }
+        return 5 /* Longs */;
+      }
+      if (!Array.isArray(it.values)) {
+        throw argumentError(`array ${this.id}: the values destination must be an Array`);
+      }
+      return it.minHi === 0 && it.maxHi === 0 ? 1 /* Values32 */ : 0 /* Values */;
     }
-    resetVarint() {
-      this.vLo = 0;
-      this.vHi = 0;
-      this.vBytes = 0;
+    /** The typed-destination check of {@link resolveTarget} for an unsigned array. */
+    typedModeU(it, d, kind, count) {
+      if (d.length < count) {
+        throw argumentError(
+          `array ${this.id}: typed destination holds ${d.length} of ${count} elements`
+        );
+      }
+      const cap = typedCapacity(d.constructor);
+      const signed = kind === ArrayKind.Signed;
+      if ((cap === void 0 || cap.max === Number.POSITIVE_INFINITY) && is64(d)) {
+        if (signed !== d instanceof BigInt64Array) {
+          throw argumentError(
+            `array ${this.id}: a 64-bit typed destination must match the array's signedness`
+          );
+        }
+        this.bulk64 = new Uint32Array(d.buffer, d.byteOffset, d.length * 2);
+        return 3 /* Typed64 */;
+      }
+      const minV = signed ? (it.minHi | 0) * TWO32 + it.minLo : it.minHi * TWO32 + it.minLo;
+      const maxV = signed ? (it.maxHi | 0) * TWO32 + it.maxLo : it.maxHi * TWO32 + it.maxLo;
+      if (cap === void 0) {
+        throw argumentError(`array ${this.id}: unsupported typed destination`);
+      }
+      if (minV < cap.min || maxV > cap.max) {
+        throw argumentError(
+          `array ${this.id}: the element bound ${minV}..${maxV} does not fit the typed destination (${cap.min}..${cap.max})`
+        );
+      }
+      return 2 /* Typed */;
+    }
+    /** The signed twin of {@link typedModeU}: textually identical, for its own inline caches. */
+    typedModeS(it, d, kind, count) {
+      if (d.length < count) {
+        throw argumentError(
+          `array ${this.id}: typed destination holds ${d.length} of ${count} elements`
+        );
+      }
+      const cap = typedCapacity(d.constructor);
+      const signed = kind === ArrayKind.Signed;
+      if ((cap === void 0 || cap.max === Number.POSITIVE_INFINITY) && is64(d)) {
+        if (signed !== d instanceof BigInt64Array) {
+          throw argumentError(
+            `array ${this.id}: a 64-bit typed destination must match the array's signedness`
+          );
+        }
+        this.bulk64 = new Uint32Array(d.buffer, d.byteOffset, d.length * 2);
+        return 3 /* Typed64 */;
+      }
+      const minV = signed ? (it.minHi | 0) * TWO32 + it.minLo : it.minHi * TWO32 + it.minLo;
+      const maxV = signed ? (it.maxHi | 0) * TWO32 + it.maxLo : it.maxHi * TWO32 + it.maxLo;
+      if (cap === void 0) {
+        throw argumentError(`array ${this.id}: unsupported typed destination`);
+      }
+      if (minV < cap.min || maxV > cap.max) {
+        throw argumentError(
+          `array ${this.id}: the element bound ${minV}..${maxV} does not fit the typed destination (${cap.min}..${cap.max})`
+        );
+      }
+      return 2 /* Typed */;
+    }
+    /**
+     * The whole `S.ArrayUElem` arm for an array whose destination was handed over:
+     * drain what this chunk holds, store a straddling tail element, close the array
+     * when it ends. Returns the new read position; the caller's `break` then either
+     * re-enters this state for the next chunk or leaves it, exactly as before.
+     *
+     * **Out of line, for the reason {@link fpDrain} already gives.** Everything
+     * written into {@link push}'s switch is paid for by every decode that never
+     * reaches it, so this arm is three lines at the call site and a method here.
+     * Carrying its body in the switch instead cost `decode: typical` 5092 -> 5099
+     * Ir/op and `decode: u64 array` 705.0k -> 708.5k; giving each bulk arm a state
+     * of its own — which keeps the per-element arms untouched but adds three labels
+     * — cost 5163 on `typical`, worse than either. What is left is what the
+     * hand-off costs a decode that never takes it: 0.34% (5075 -> 5092, 702.5k ->
+     * 705.0k), in the loop's own size.
+     *
+     * Suspension needs no signal of its own: a varint that did not complete consumed
+     * the chunk to its end, so the returned position is `n` and the decode loop exits
+     * on its own condition.
+     *
+     * **One loop per destination**, chosen once (see {@link bulkMode}) rather than
+     * branched on per element: the shapes differ only in what a stored element *is*,
+     * and a loop deciding that per element would give back what the hand-off saves.
+     * `arrIndex` is likewise written once per drain instead of once per element,
+     * which is part of why a bulk fill costs less than *discarding* the same
+     * elements. A refusal mid-loop leaves it at the last committed value; nothing
+     * reads it afterwards, because that verdict is terminal (§5.2.1).
+     */
+    uBulkArm(input, i, n, count, safeEnd) {
+      const t = this.bulk;
+      const mode = this.bulkMode;
+      const minLo = t.minLo;
+      const minHi = t.minHi;
+      const maxLo = t.maxLo;
+      const maxHi = t.maxHi;
+      for (; ; ) {
+        if (this.vBytes === 0) {
+          let idx = this.arrIndex;
+          if (mode === 1 /* Values32 */) {
+            const out = t.values;
+            while (idx < count && i <= safeEnd) {
+              i = this.varintFull(input, i);
+              const lo = this.vLo >>> 0;
+              if (this.vHi !== 0 || lo < minLo || lo > maxLo) this.outOfBound(idx);
+              out[idx++] = lo;
+            }
+          } else if (mode === 2 /* Typed */) {
+            const out = t.typed;
+            while (idx < count && i <= safeEnd) {
+              i = this.varintFull(input, i);
+              const lo = this.vLo >>> 0;
+              if (this.vHi !== 0 || lo < minLo || lo > maxLo) this.outOfBound(idx);
+              out[idx++] = lo;
+            }
+          } else if (mode === 3 /* Typed64 */) {
+            const out = this.bulk64;
+            while (idx < count && i <= safeEnd) {
+              i = this.varintFull(input, i);
+              const lo = this.vLo >>> 0;
+              const hi = this.vHi >>> 0;
+              if (hi < minHi || hi === minHi && lo < minLo || hi > maxHi || hi === maxHi && lo > maxLo) {
+                this.outOfBound(idx);
+              }
+              out[idx * 2 + LO] = lo;
+              out[idx * 2 + HI] = hi;
+              idx++;
+            }
+          } else if (mode === 4 /* Bool */) {
+            const out = this.bulk.bool;
+            while (idx < count && i <= safeEnd) {
+              i = this.varintFull(input, i);
+              out[idx++] = this.vLo !== 0 || this.vHi !== 0 ? 1 : 0;
+            }
+          } else if (mode === 0 /* Values */) {
+            const out = t.values;
+            while (idx < count && i <= safeEnd) {
+              i = this.varintFull(input, i);
+              const lo = this.vLo >>> 0;
+              const hi = this.vHi >>> 0;
+              if (hi < minHi || hi === minHi && lo < minLo || hi > maxHi || hi === maxHi && lo > maxLo) {
+                this.outOfBound(idx);
+              }
+              out[idx++] = hi <= 2097151 ? hi * TWO32 + lo : joinU64(lo, hi);
+            }
+          } else if (mode === 5 /* Longs */) {
+            const out = t.longs;
+            while (idx < count && i <= safeEnd) {
+              i = this.varintFull(input, i);
+              const lo = this.vLo >>> 0;
+              const hi = this.vHi >>> 0;
+              if (hi < minHi || hi === minHi && lo < minLo || hi > maxHi || hi === maxHi && lo > maxLo) {
+                this.outOfBound(idx);
+              }
+              out[idx++] = new Long(lo, hi);
+            }
+          } else {
+            const oLo = t.lo;
+            const oHi = t.hi;
+            while (idx < count && i <= safeEnd) {
+              i = this.varintFull(input, i);
+              const lo = this.vLo >>> 0;
+              const hi = this.vHi >>> 0;
+              if (hi < minHi || hi === minHi && lo < minLo || hi > maxHi || hi === maxHi && lo > maxLo) {
+                this.outOfBound(idx);
+              }
+              oLo[idx] = lo;
+              oHi[idx] = hi;
+              idx++;
+            }
+          }
+          this.arrIndex = idx;
+        }
+        if (this.arrIndex === count) {
+          this.endArray();
+          return i;
+        }
+        if (i >= n) return i;
+        i = this.varintStep(input, i);
+        if (!this.vComplete) return i;
+        this.bulkStoreU(this.arrIndex, this.vLo >>> 0, this.vHi >>> 0);
+        if (++this.arrIndex === count) {
+          this.endArray();
+          return i;
+        }
+      }
+    }
+    /** The signed twin of {@link uBulkArm}: the same shape, with the zig-zag undone. */
+    sBulkArm(input, i, n, count, safeEnd) {
+      const t = this.bulk;
+      const mode = this.bulkMode;
+      const minLo = t.minLo;
+      const minHi = t.minHi | 0;
+      const maxLo = t.maxLo;
+      const maxHi = t.maxHi | 0;
+      for (; ; ) {
+        if (this.vBytes === 0) {
+          let idx = this.arrIndex;
+          while (idx < count && i <= safeEnd) {
+            i = this.varintFull(input, i);
+            const raw = this.vLo >>> 0;
+            const rawHi = this.vHi >>> 0;
+            const mask = -(raw & 1) >>> 0;
+            const lo = ((raw >>> 1 | rawHi << 31) >>> 0 ^ mask) >>> 0;
+            const hi = (rawHi >>> 1 ^ mask) >>> 0;
+            const shi = hi | 0;
+            if (shi < minHi || shi === minHi && lo < minLo || shi > maxHi || shi === maxHi && lo > maxLo) {
+              this.outOfBound(idx);
+            }
+            if (mode === 2 /* Typed */) {
+              t.typed[idx] = lo | 0;
+            } else if (mode === 3 /* Typed64 */) {
+              const o = this.bulk64;
+              o[idx * 2 + LO] = lo;
+              o[idx * 2 + HI] = hi;
+            } else if (mode === 0 /* Values */ || mode === 1 /* Values32 */) {
+              let v;
+              if (rawHi <= 2097151) {
+                const r = rawHi * TWO32 + raw;
+                v = r % 2 === 0 ? r / 2 : -(r + 1) / 2;
+              } else {
+                v = joinI64(lo, hi);
+              }
+              t.values[idx] = v;
+            } else if (mode === 5 /* Longs */) {
+              t.longs[idx] = new Long(lo, hi);
+            } else {
+              t.lo[idx] = lo;
+              t.hi[idx] = hi;
+            }
+            idx++;
+          }
+          this.arrIndex = idx;
+        }
+        if (this.arrIndex === count) {
+          this.endArray();
+          return i;
+        }
+        if (i >= n) return i;
+        i = this.varintStep(input, i);
+        if (!this.vComplete) return i;
+        this.bulkStoreS(this.arrIndex, this.vLo >>> 0, this.vHi >>> 0);
+        if (++this.arrIndex === count) {
+          this.endArray();
+          return i;
+        }
+      }
+    }
+    /** The float twin of {@link uBulkArm}; a straddling element resumes through {@link fpStep}. */
+    fpBulkArm(input, i, n, count, size, isFp32) {
+      if (this.have === 0 && this.arrIndex < count && n - i >= size) {
+        const t = this.bulk;
+        const run = Math.min(count - this.arrIndex, (n - i) / size | 0);
+        let idx = this.arrIndex;
+        const bitsOut = this.bulkMode === 8 /* F32Bits */ ? t.bits : null;
+        if (run >= (isFp32 ? FP32_HANDLE_MIN : FP64_HANDLE_MIN)) {
+          const dv = this.dataView(input);
+          if (bitsOut !== null) {
+            for (let k = 0; k < run; k++) {
+              bitsOut[idx++] = dv.getUint32(i, true);
+              i += 4;
+            }
+          } else if (isFp32) {
+            const out = t.f32;
+            for (let k = 0; k < run; k++) {
+              const v = dv.getFloat32(i, true);
+              if (v === v) out[idx] = v;
+              else this.f32StoreWord(out, idx, dv.getUint32(i, true));
+              idx++;
+              i += 4;
+            }
+          } else {
+            const out = t.f64;
+            for (let k = 0; k < run; k++) {
+              out[idx++] = dv.getFloat64(i, true);
+              i += 8;
+            }
+          }
+        } else if (bitsOut !== null) {
+          for (let k = 0; k < run; k++) {
+            bitsOut[idx++] = u32le(input, i);
+            i += 4;
+          }
+        } else if (isFp32) {
+          const out = t.f32;
+          for (let k = 0; k < run; k++) {
+            const w = u32le(input, i);
+            if ((w & 2147483647) > 2139095040) this.f32StoreWord(out, idx, w);
+            else out[idx] = fp32FromBits(w);
+            idx++;
+            i += 4;
+          }
+        } else {
+          const out = t.f64;
+          for (let k = 0; k < run; k++) {
+            out[idx++] = fp64FromBits(u32le(input, i), u32le(input, i + 4));
+            i += 8;
+          }
+        }
+        this.arrIndex = idx;
+      }
+      if (this.arrIndex === count) {
+        this.endArray();
+        return i;
+      }
+      if (i >= n) return i;
+      i = this.fpStep(input, i, n);
+      if (this.have < this.need) return i;
+      const lo = this.fpLo;
+      const hi = this.fpHi;
+      this.fpBegin(size);
+      this.bulkStoreFp(this.arrIndex, lo, hi, isFp32);
+      if (++this.arrIndex === count) this.endArray();
+      return i;
+    }
+    /**
+     * Store an fp32 NaN into a `Float32Array` destination by its wire word (§4.6).
+     * Widening a NaN to a double quiets a signaling one (and an engine may purify
+     * the payload of any NaN it reads from a typed array), so a NaN never goes
+     * through a value: it is written through a word view over the destination's own
+     * storage. Every other fp32 survives the double exactly, which is why the view
+     * is built lazily, on the array's first NaN, and never on the common path —
+     * touching `.buffer` moves a small typed array's storage off the heap. It is
+     * kept in {@link bulk64} for the rest of the array, so the count is one per
+     * array however many NaNs the wire carries (§6.6.2).
+     */
+    f32StoreWord(out, idx, word) {
+      let w = this.bulk64;
+      if (w === null) w = this.bulk64 = new Uint32Array(out.buffer, out.byteOffset, out.length);
+      w[idx] = word;
+    }
+    /** Store one float element that straddled a chunk boundary (see {@link bulkStoreU}). */
+    bulkStoreFp(idx, lo, hi, isFp32) {
+      const t = this.bulk;
+      if (!isFp32) t.f64[idx] = fp64FromBits(lo, hi);
+      else if (this.bulkMode === 8 /* F32Bits */) t.bits[idx] = lo >>> 0;
+      else if ((lo & 2147483647) > 2139095040) this.f32StoreWord(t.f32, idx, lo >>> 0);
+      else t.f32[idx] = fp32FromBits(lo);
+    }
+    /**
+     * Store one unsigned element that straddled a chunk boundary — the tail a drain
+     * loop cannot take, resumed from the varint accumulator. At most one per chunk,
+     * so it re-decides the destination rather than duplicating three loops.
+     */
+    bulkStoreU(idx, lo, hi) {
+      const t = this.bulk;
+      if (hi < t.minHi || hi === t.minHi && lo < t.minLo || hi > t.maxHi || hi === t.maxHi && lo > t.maxLo) {
+        this.outOfBound(idx);
+      }
+      if (this.bulkMode === 0 /* Values */ || this.bulkMode === 1 /* Values32 */) {
+        t.values[idx] = this.vUnsigned();
+      } else if (this.bulkMode === 2 /* Typed */) {
+        t.typed[idx] = lo;
+      } else if (this.bulkMode === 3 /* Typed64 */) {
+        const o = this.bulk64;
+        o[idx * 2 + LO] = lo;
+        o[idx * 2 + HI] = hi;
+      } else if (this.bulkMode === 4 /* Bool */) {
+        this.bulk.bool[idx] = lo !== 0 || hi !== 0 ? 1 : 0;
+      } else if (this.bulkMode === 5 /* Longs */) {
+        t.longs[idx] = new Long(lo, hi);
+      } else {
+        t.lo[idx] = lo;
+        t.hi[idx] = hi;
+      }
+    }
+    /** The signed twin of {@link bulkStoreU}; `raw`/`rawHi` are the zig-zag halves. */
+    bulkStoreS(idx, raw, rawHi) {
+      const t = this.bulk;
+      const mask = -(raw & 1) >>> 0;
+      const lo = ((raw >>> 1 | rawHi << 31) >>> 0 ^ mask) >>> 0;
+      const hi = (rawHi >>> 1 ^ mask) >>> 0;
+      const shi = hi | 0;
+      if (shi < (t.minHi | 0) || shi === (t.minHi | 0) && lo < t.minLo || shi > (t.maxHi | 0) || shi === (t.maxHi | 0) && lo > t.maxLo) {
+        this.outOfBound(idx);
+      }
+      if (this.bulkMode === 0 /* Values */ || this.bulkMode === 1 /* Values32 */) {
+        t.values[idx] = this.vSigned();
+      } else if (this.bulkMode === 2 /* Typed */) t.typed[idx] = lo | 0;
+      else if (this.bulkMode === 3 /* Typed64 */) {
+        const o = this.bulk64;
+        o[idx * 2 + LO] = lo;
+        o[idx * 2 + HI] = hi;
+      } else if (this.bulkMode === 5 /* Longs */) t.longs[idx] = new Long(lo, hi);
+      else {
+        t.lo[idx] = lo;
+        t.hi[idx] = hi;
+      }
+    }
+    /**
+     * Refuse an element outside the bound its target declared (§7.3): the message
+     * says a thing the schema does not allow, so it is `INVALID` and terminal, the
+     * same verdict at the same point as a generated per-element guard raises today.
+     * The destination keeps everything written before this element — see
+     * {@link ArrayTarget}.
+     */
+    outOfBound(index) {
+      const t = this.bulk;
+      if (t !== null) this.trimPlain(t, index);
+      this.fail(`array ${this.id}: element ${index} outside the schema bound`);
+    }
+    /**
+     * Report one payload piece: the caller's own fed chunk plus the coordinates of
+     * the piece inside it (§6.6.3). No view is created — this decoder allocates
+     * nothing (§6.6) and exposes no borrowed slice of its own (§6.7); `src` is the
+     * very array the caller passed to `feed`, so whoever wants the bytes copies
+     * them out of memory it already owns, during the call.
+     */
+    emitBytes(src, start, end) {
+      const v = this.cur;
+      if (this.fixSub === FixlenSubtype.String) {
+        v.string?.(this.id, this.fixLen, this.fixOff, src, start, end);
+      } else {
+        v.blob?.(this.id, this.fixLen, this.fixOff, src, start, end);
+      }
+    }
+    /**
+     * Consume varint bytes from `input` at `i` into the {@link vLo} / {@link vHi}
+     * accumulator, resuming across chunk boundaries; sets {@link vComplete} when a
+     * terminator byte arrives. Number-only — no per-byte `bigint`.
+     */
+    varintStep(input, i) {
+      if (this.vBytes === 0) {
+        const n0 = input.length;
+        const b0 = input[i];
+        if (b0 < 128) {
+          this.vLo = b0;
+          this.vHi = 0;
+          this.vComplete = true;
+          return i + 1;
+        }
+        if (i + 1 < n0) {
+          const b1 = input[i + 1];
+          if (b1 < 128) {
+            this.vLo = b0 & 127 | b1 << 7;
+            this.vHi = 0;
+            this.vComplete = true;
+            return i + 2;
+          }
+          if (i + 2 < n0) {
+            const b2 = input[i + 2];
+            if (b2 < 128) {
+              this.vLo = b0 & 127 | (b1 & 127) << 7 | b2 << 14;
+              this.vHi = 0;
+              this.vComplete = true;
+              return i + 3;
+            }
+          }
+        }
+        if (n0 - i >= VARINT_MAX_BYTES) return this.varintFull(input, i);
+      }
+      const k0 = this.vBytes;
+      let lo = k0 === 0 ? 0 : this.vLo;
+      let hi = k0 === 0 ? 0 : this.vHi;
+      let k = k0;
+      const n = input.length;
+      while (i < n) {
+        if (k >= VARINT_MAX_BYTES) this.fail("varint overflow");
+        const b = input[i++];
+        if (k < 4) lo |= (b & 127) << 7 * k;
+        else if (k === 4) {
+          lo |= (b & 15) << 28;
+          hi |= b >> 4 & 7;
+        } else {
+          if (k === 9 && (b & 127) >> 1 !== 0) this.fail("varint overflow");
+          hi |= (b & 127) << 7 * k - 32;
+        }
+        k++;
+        if ((b & 128) === 0) {
+          this.vLo = lo;
+          this.vHi = hi;
+          this.vBytes = 0;
+          this.vComplete = true;
+          return i;
+        }
+      }
+      if (k >= VARINT_MAX_BYTES) this.fail("varint overflow");
+      this.vLo = lo;
+      this.vHi = hi;
+      this.vBytes = k;
       this.vComplete = false;
+      return i;
     }
-    /** The accumulated varint as a `bigint` (full 64-bit fidelity). */
-    vBig() {
-      return this.vHi === 0 ? BigInt(this.vLo >>> 0) : BigInt(this.vHi >>> 0) << 32n | BigInt(this.vLo >>> 0);
+    /**
+     * Decode the varint at `i` **if that needs no resume bookkeeping**, returning
+     * the index past it, or `-1` when it does (leaving the accumulator untouched,
+     * so the resumable ladder starts the word from scratch).
+     *
+     * Three cases, in the order they are worth testing:
+     *
+     * * ten bytes in hand — the unrolled {@link varintFull}, no bounds checks at
+     *   all;
+     * * a one-byte varint — every small id, length, count and scalar;
+     * * a two-byte one — every id past 15, and mid-sized lengths and counts.
+     *
+     * Past that the word may straddle the chunk, and only the ladder can carry the
+     * state across `feed` calls.
+     */
+    varintQuick(input, i, n) {
+      if (n - i >= VARINT_MAX_BYTES) return this.varintFull(input, i);
+      if (i >= n) return -1;
+      const b0 = input[i];
+      if (b0 < 128) return this.setVarint(b0, 0, i + 1);
+      if (i + 1 < n) {
+        const b1 = input[i + 1];
+        if (b1 < 128) return this.setVarint(b0 & 127 | b1 << 7, 0, i + 2);
+        if (i + 2 < n) {
+          const b2 = input[i + 2];
+          if (b2 < 128) {
+            return this.setVarint(b0 & 127 | (b1 & 127) << 7 | b2 << 14, 0, i + 3);
+          }
+        }
+      }
+      return -1;
     }
     /**
-     * The accumulated varint as an unsigned value, number-first: a `number` when
-     * it fits exactly (`≤ 2^53-1`, which covers all ids, u8..u32 and small u64s),
-     * a `bigint` only beyond that. Avoids a bigint allocation on the common path.
+     * Decode one varint that is **guaranteed** to lie wholly within `input` — the
+     * caller has checked that {@link VARINT_MAX_BYTES} bytes remain — into
+     * {@link vLo} / {@link vHi}, returning the index past it.
+     *
+     * Unrolled and branch-per-byte: with the bytes known to be present there is no
+     * bounds check, no resume counter and no `k`-dispatch per byte, which is the
+     * whole per-byte cost of the resumable loop above. Reports the same `>64-bit`
+     * overflow as that loop.
+     */
+    varintFull(input, i) {
+      let b = input[i];
+      let lo = b & 127;
+      let hi = 0;
+      if (b < 128) return this.setVarint(lo, 0, i + 1);
+      b = input[i + 1];
+      lo |= (b & 127) << 7;
+      if (b < 128) return this.setVarint(lo, 0, i + 2);
+      b = input[i + 2];
+      lo |= (b & 127) << 14;
+      if (b < 128) return this.setVarint(lo, 0, i + 3);
+      b = input[i + 3];
+      lo |= (b & 127) << 21;
+      if (b < 128) return this.setVarint(lo, 0, i + 4);
+      b = input[i + 4];
+      lo |= (b & 15) << 28;
+      hi = b >> 4 & 7;
+      if (b < 128) return this.setVarint(lo, hi, i + 5);
+      b = input[i + 5];
+      hi |= (b & 127) << 3;
+      if (b < 128) return this.setVarint(lo, hi, i + 6);
+      b = input[i + 6];
+      hi |= (b & 127) << 10;
+      if (b < 128) return this.setVarint(lo, hi, i + 7);
+      b = input[i + 7];
+      hi |= (b & 127) << 17;
+      if (b < 128) return this.setVarint(lo, hi, i + 8);
+      b = input[i + 8];
+      hi |= (b & 127) << 24;
+      if (b < 128) return this.setVarint(lo, hi, i + 9);
+      b = input[i + 9];
+      if ((b & 127) >> 1 !== 0) this.fail("varint overflow");
+      hi |= (b & 127) << 31;
+      if (b < 128) return this.setVarint(lo, hi, i + 10);
+      this.fail("varint overflow");
+    }
+    /** Publish a fully-decoded varint and the cursor past it (see {@link varintFull}). */
+    setVarint(lo, hi, i) {
+      this.vLo = lo;
+      this.vHi = hi;
+      this.vBytes = 0;
+      this.vComplete = true;
+      return i;
+    }
+    /**
+     * The accumulated varint as an unsigned value, number-first: a `number` when it
+     * fits exactly (`≤ 2^53-1`, which covers all ids, u8..u32 and small u64s), a
+     * `bigint` only beyond that.
      */
     vUnsigned() {
       const hi = this.vHi >>> 0;
-      return hi <= 2097151 ? hi * TWO322 + (this.vLo >>> 0) : this.vBig();
+      return hi <= 2097151 ? hi * TWO32 + (this.vLo >>> 0) : joinU64(this.vLo >>> 0, hi);
     }
     /** The accumulated zig-zag varint as a signed value, number-first (see {@link vUnsigned}). */
     vSigned() {
       const hi = this.vHi >>> 0;
       if (hi <= 2097151) {
-        const r = hi * TWO322 + (this.vLo >>> 0);
+        const r = hi * TWO32 + (this.vLo >>> 0);
         return r % 2 === 0 ? r / 2 : -(r + 1) / 2;
       }
-      return zigzagDecode(this.vBig());
+      const lo = this.vLo >>> 0;
+      const mask = -(lo & 1) >>> 0;
+      return joinI64(
+        ((lo >>> 1 | hi << 31) >>> 0 ^ mask) >>> 0,
+        (hi >>> 1 ^ mask) >>> 0
+      );
     }
-    /** The accumulated varint as a JS number — exact for ids/lengths/counts. */
+    /**
+     * The accumulated varint as a JS number — exact for ids/lengths/counts.
+     *
+     * The `>>> 0` is load-bearing: `vHi` is accumulated with 32-bit bitwise ops, so
+     * bit 63 of the varint lands on its sign bit and the value reads back negative,
+     * sliding past the `count > ARRAY_MAX` guard.
+     */
     vNum() {
-      return this.vHi * TWO322 + (this.vLo >>> 0);
-    }
-    /** The accumulated varint's low 3 tag bits (the wire type / fixlen subtype). */
-    vTag() {
-      return this.vLo & 7;
+      return (this.vHi >>> 0) * TWO32 + (this.vLo >>> 0);
     }
     /** The accumulated varint with its low 3 tag bits stripped (`value >> 3`). */
     vUpper() {
-      return (this.vHi >>> 0) * (TWO322 / 8) + (this.vLo >>> 3);
+      return (this.vHi >>> 0) * (TWO32 / 8) + (this.vLo >>> 3);
     }
-    /** Accumulate `need` raw bytes into {@link scratch}. */
-    fpStep(input, i) {
-      while (this.have < this.need && i < input.length) {
-        this.scratch[this.have++] = input[i++];
+    /**
+     * The handle over `input`, built on demand and reused while the same chunk is
+     * being fed (see {@link view}).
+     */
+    dataView(input) {
+      if (this.viewOf !== input) {
+        this.view = new DataView(input.buffer, input.byteOffset, input.byteLength);
+        this.viewOf = input;
       }
+      return this.view;
+    }
+    /** Accumulate up to `need` raw float bytes into {@link fpLo} / {@link fpHi}. */
+    fpStep(input, i, n) {
+      let have = this.have;
+      const need = this.need;
+      while (have < need && i < n) {
+        const b = input[i++];
+        if (have < 4) this.fpLo |= b << (have << 3);
+        else this.fpHi |= b << (have - 4 << 3);
+        have++;
+      }
+      this.have = have;
       return i;
     }
+    /** Start a fresh fp accumulation of `need` bytes. */
+    fpBegin(need) {
+      this.need = need;
+      this.have = 0;
+      this.fpLo = 0;
+      this.fpHi = 0;
+    }
   };
+  function u32le(b, i) {
+    return (b[i] | b[i + 1] << 8 | b[i + 2] << 16 | b[i + 3] << 24) >>> 0;
+  }
 
   // src/decode/istream.ts
   var IStream = class {
     /**
-     * @param limits Optional opt-in decode caps ({@link DecodeLimits}). An
-     * over-limit array count or string / blob length throws {@link SofabError}
-     * (`LIMIT_EXCEEDED`) from {@link feed}, at the offending field's header and
-     * before any of its payload is streamed to the visitor. Omit for no caps.
-     */
-    constructor(limits) {
-      this.state = new DecoderState(limits);
-    }
-    /**
-     * Feed a chunk of bytes, dispatching decoded fields to `visitor`. Throws
-     * {@link SofabError} (`INVALID_MSG`) only if the bytes are *malformed*;
-     * running out of bytes mid-field is not an error — it simply suspends until
-     * the next chunk (see {@link end}).
+     * @param visitor The field handler this stream drives, for its whole life — and
+     * the layer that holds the receiver caps, if any (§6.2.1; see the class doc).
      */
-    feed(chunk, visitor) {
-      this.state.push(chunk, visitor);
+    constructor(visitor) {
+      this.state = new DecoderState(visitor);
     }
     /**
-     * Report whether the stream ended exactly at a field boundary. Call after the
-     * final {@link feed}: returns {@link DecodeStatus.Complete} at a clean field
-     * boundary, or {@link DecodeStatus.Incomplete} if the last chunk ended inside
-     * a field (a partial varint, an unfinished payload / array, or a still-open
-     * nested sequence).
+     * Feed a chunk of bytes, dispatching decoded fields to the bound visitor, and
+     * **return** where the decode stands after them (§5.2.1):
+     * {@link DecodeStatus.Complete} when they end exactly at a field boundary,
+     * {@link DecodeStatus.Incomplete} when they end *inside* a field (a partial
+     * varint, an unfinished payload / array, or a still-open nested sequence).
+     * Running out of bytes mid-field is not an error — the decode merely suspends
+     * until the next chunk, and the caller owns end-of-input.
      *
-     * Per the finish-less spec (MESSAGE_SPEC §7) this is a pure accessor: it never
-     * throws and never promotes an incomplete decode to an error — the caller owns
-     * end-of-input and decides whether a trailing `Incomplete` is a truncation
-     * error. (A *malformed* message has already thrown from {@link feed}.)
+     * **This call is the only place the answer is.** There is no finish / finalize
+     * step (§5.2.4) and no status accessor: what this returns, or throws, is the
+     * whole of what the stream has to say, so a caller is never one question short
+     * after it and never has two answers to reconcile. Feeding an empty chunk
+     * re-reads the same value without consuming anything, for a caller that wants
+     * the outcome again without holding on to it.
+     *
+     * The chunk is borrowed **only for the duration of this call** (§6.0): once it
+     * returns, the caller may reuse, overwrite or free that memory, and the decoded
+     * message is unaffected — the decoder retains nothing that points into it.
+     *
+     * `INVALID` travels on the error channel — this port's idiomatic surfacing of
+     * it: *malformed* bytes throw {@link SofabError} (`INVALID_MSG`) instead of
+     * returning a status, which is why the return type names only the other two.
+     * That verdict is **terminal** (§5.2.1): the stream latches it, so a caller that
+     * catches the throw and feeds on gets the same error again from every later
+     * call — no further byte is consumed and no visitor method is invoked. A caller
+     * that caught it already holds the verdict, in the code on the error it caught.
+     *
+     * A receiver-limit rejection (`LIMIT_EXCEEDED`, §6.2.1) travels the same
+     * channel — thrown out of the visitor callback that compared the cap — but it
+     * is **not** the `INVALID` outcome and never becomes one: the bytes are
+     * well-formed and the same message decodes under a looser cap, so it is a
+     * policy rejection (§6.2.1, §6.3). The two stay distinguishable by their code,
+     * which is what §6.3 requires; §6.3 leaves the surfacing open between "a fourth
+     * decode outcome" and "a terminal failure carrying the `LimitExceeded` code on
+     * the error channel", and this port takes the second. **Terminal** is the other
+     * half of that sentence and holds exactly as it does for `INVALID`: the stream
+     * latches the rejection, so every later call re-throws it under the same code,
+     * consumes no byte and drives no visitor method. It is *only* on the error
+     * channel — the three-valued outcome has no value for "valid, but more than I am
+     * configured to accept", so there is nothing about it to read back as a status,
+     * and nothing that has to be kept in step with the throw.
      */
-    end() {
-      return this.state.finish();
+    feed(chunk) {
+      this.state.push(chunk);
+      return this.state.outcome();
     }
   };
-  function decode(bytes, visitor, limits) {
-    decodeContiguous(bytes, visitor, limits);
+  function decode(bytes, visitor) {
+    const state = pooled ?? new DecoderState();
+    pooled = null;
+    try {
+      state.begin(visitor);
+      state.push(bytes);
+      if (state.outcome() !== DecodeStatus.Complete) {
+        throw incompleteError("truncated message: input ends inside a field");
+      }
+    } finally {
+      state.release();
+      pooled = state;
+    }
   }
+  var pooled = null;
 
-  // src/decode/cursor.ts
-  var TWO323 = 4294967296;
+  // src/decode/text.ts
   var _utf8 = new TextDecoder("utf-8", { fatal: true });
-  var Cursor = class {
-    constructor(buf, limits) {
-      /** Field id of the header last accepted by {@link readHeader}. */
-      this.id = 0;
-      /** Wire type of the header last accepted by {@link readHeader}. */
-      this.wire = 0;
-      /**
-       * Fixlen subtype of the header last accepted by {@link readHeader} — one of
-       * {@link FixlenSubtype} — when its {@link wire} is {@link WireType.Fixlen} or
-       * {@link WireType.ArrayFixlen}; `-1` otherwise (a non-fixlen field, or a
-       * fixlen field whose subtype word is truncated away).
-       *
-       * The four fixlen subtypes (`fp32`, `fp64`, `string`, `blob`) all share one
-       * {@link wire} type, so {@link wire} alone cannot separate them. This is the
-       * companion accessor that can: a generated guard reads it right after
-       * {@link readHeader} to skip a field whose delivered subtype contradicts the
-       * schema (MESSAGE_SPEC §7.3), exactly as it already does on {@link wire} for
-       * the other kinds:
-       *
-       * ```ts
-       * case 9: if (c.wire !== WireType.Fixlen || c.fixSub !== FixlenSubtype.Fp64) {
-       *   c.skip(c.wire); break;
-       * } o.somefp64 = c.readFp64(); break;
-       * ```
-       *
-       * It is *peeked* — the subtype word is not consumed — so the matching typed
-       * reader (or {@link skip}) still reads and validates it, and a malformed or
-       * truncated word surfaces `INVALID` / `INCOMPLETE` there as before.
-       */
-      this.fixSub = -1;
-      this.p = 0;
-      // Last varint, as two unsigned 32-bit halves (see readVarint).
-      this.lo = 0;
-      this.hi = 0;
-      // Number of nested sequences currently open (0 = root). Incremented when
-      // readHeader accepts a SequenceStart, decremented when it consumes the matching
-      // SequenceEnd (or when skip() discards a whole nested sequence). Lets the pull
-      // parser tell a root-level dangling sequence-end (INVALID) and an unclosed
-      // sequence at end-of-buffer (INCOMPLETE) apart from a clean boundary.
-      this.depth = 0;
-      this.buf = buf;
-      this.n = buf.length;
-      this.view = new DataView(buf.buffer, buf.byteOffset, buf.length);
-      this.maxArrayCount = limits?.maxArrayCount ?? Infinity;
-      this.maxStringLen = limits?.maxStringLen ?? Infinity;
-      this.maxBlobLen = limits?.maxBlobLen ?? Infinity;
-    }
-    /**
-     * Advance to the next field header. Returns `true` and sets {@link id} /
-     * {@link wire} when a field follows; returns `false` — consuming the marker —
-     * at the end of the buffer *or* at the sequence-end that closes the sequence
-     * this decoder is reading. So a generated per-type decoder loops uniformly:
-     *
-     * ```ts
-     * while (c.readHeader()) {
-     *   switch (c.id) {
-     *     case 4: this.u32 = Number(c.readUnsigned()); break;
-     *     case 10: this.child = Child.decodeFrom(c); break; // nested sequence
-     *     default: c.skip(c.wire); break;                   // unknown field
-     *   }
-     * }
-     * ```
-     *
-     * At the root the loop ends at end-of-buffer; inside a nested sequence it ends
-     * at the matching {@link WireType.SequenceEnd} (which is consumed). A field
-     * whose id is out of range throws {@link SofabError} (`INVALID_MSG`).
-     */
-    readHeader() {
-      if (this.p >= this.n) {
-        if (this.depth > 0) {
-          throw incompleteError("truncated message: unbalanced sequence");
+  var FLAT_MAX = 16;
+  function decodeUtf8(buf, start = 0, end = buf.length) {
+    const n = end - start;
+    if (n <= 0) return "";
+    if (n <= FLAT_MAX) {
+      let ascii = true;
+      for (let k = start; k < end; k++) {
+        if (buf[k] & 128) {
+          ascii = false;
+          break;
         }
-        return false;
       }
-      this.readVarint();
-      const wire = this.lo & 7;
-      if (wire === WireType.SequenceEnd) {
-        if (this.depth === 0) {
-          throw invalidMsgError("unbalanced sequence end");
-        }
-        this.depth--;
-        return false;
-      }
-      const id = this.upper();
-      if (id > ID_MAX) throw invalidMsgError(`field id ${id} out of range`);
-      if (wire === WireType.SequenceStart) {
-        if (this.depth >= MAX_DEPTH) {
-          throw invalidMsgError(`nesting exceeds MAX_DEPTH (${MAX_DEPTH})`);
+      if (ascii) {
+        switch (n) {
+          case 1:
+            return String.fromCharCode(buf[start]);
+          case 2:
+            return String.fromCharCode(buf[start], buf[start + 1]);
+          case 3:
+            return String.fromCharCode(buf[start], buf[start + 1], buf[start + 2]);
+          case 4:
+            return String.fromCharCode(buf[start], buf[start + 1], buf[start + 2], buf[start + 3]);
+          case 5:
+            return String.fromCharCode(buf[start], buf[start + 1], buf[start + 2], buf[start + 3], buf[start + 4]);
+          case 6:
+            return String.fromCharCode(buf[start], buf[start + 1], buf[start + 2], buf[start + 3], buf[start + 4], buf[start + 5]);
+          case 7:
+            return String.fromCharCode(buf[start], buf[start + 1], buf[start + 2], buf[start + 3], buf[start + 4], buf[start + 5], buf[start + 6]);
+          case 8:
+            return String.fromCharCode(buf[start], buf[start + 1], buf[start + 2], buf[start + 3], buf[start + 4], buf[start + 5], buf[start + 6], buf[start + 7]);
+          case 9:
+            return String.fromCharCode(buf[start], buf[start + 1], buf[start + 2], buf[start + 3], buf[start + 4], buf[start + 5], buf[start + 6], buf[start + 7], buf[start + 8]);
+          case 10:
+            return String.fromCharCode(buf[start], buf[start + 1], buf[start + 2], buf[start + 3], buf[start + 4], buf[start + 5], buf[start + 6], buf[start + 7], buf[start + 8], buf[start + 9]);
+          case 11:
+            return String.fromCharCode(buf[start], buf[start + 1], buf[start + 2], buf[start + 3], buf[start + 4], buf[start + 5], buf[start + 6], buf[start + 7], buf[start + 8], buf[start + 9], buf[start + 10]);
+          case 12:
+            return String.fromCharCode(buf[start], buf[start + 1], buf[start + 2], buf[start + 3], buf[start + 4], buf[start + 5], buf[start + 6], buf[start + 7], buf[start + 8], buf[start + 9], buf[start + 10], buf[start + 11]);
+          case 13:
+            return String.fromCharCode(buf[start], buf[start + 1], buf[start + 2], buf[start + 3], buf[start + 4], buf[start + 5], buf[start + 6], buf[start + 7], buf[start + 8], buf[start + 9], buf[start + 10], buf[start + 11], buf[start + 12]);
+          case 14:
+            return String.fromCharCode(buf[start], buf[start + 1], buf[start + 2], buf[start + 3], buf[start + 4], buf[start + 5], buf[start + 6], buf[start + 7], buf[start + 8], buf[start + 9], buf[start + 10], buf[start + 11], buf[start + 12], buf[start + 13]);
+          case 15:
+            return String.fromCharCode(buf[start], buf[start + 1], buf[start + 2], buf[start + 3], buf[start + 4], buf[start + 5], buf[start + 6], buf[start + 7], buf[start + 8], buf[start + 9], buf[start + 10], buf[start + 11], buf[start + 12], buf[start + 13], buf[start + 14]);
+          case 16:
+            return String.fromCharCode(buf[start], buf[start + 1], buf[start + 2], buf[start + 3], buf[start + 4], buf[start + 5], buf[start + 6], buf[start + 7], buf[start + 8], buf[start + 9], buf[start + 10], buf[start + 11], buf[start + 12], buf[start + 13], buf[start + 14], buf[start + 15]);
         }
-        this.depth++;
-      }
-      this.id = id;
-      this.wire = wire;
-      this.fixSub = this.peekFixSub(wire);
-      return true;
-    }
-    /** Read an unsigned scalar (wire {@link WireType.Unsigned}), number-first. */
-    readUnsigned() {
-      this.readVarint();
-      return this.unsignedValue();
-    }
-    /** Read a signed scalar (wire {@link WireType.Signed}), zig-zag, number-first. */
-    readSigned() {
-      this.readVarint();
-      return this.signedValue();
-    }
-    /** Read a 32-bit float scalar (wire {@link WireType.Fixlen}, subtype fp32). */
-    readFp32() {
-      this.fixlenHeader(FixlenSubtype.Fp32, 4);
-      return this.rawFp32();
-    }
-    /**
-     * Read a 32-bit float scalar as its raw 4 wire bytes (little-endian), zero-copy
-     * — the bit-preserving companion to {@link readFp32}.
-     *
-     * {@link readFp32} returns a JS `number` (a 64-bit double), and widening an
-     * fp32 *signaling* NaN into a double quiets it (0x7F800001 → 0x7FC00001), so a
-     * value consumer can never round-trip one bit-for-bit (§4.6). Generated
-     * bit-exact decode reads the bytes here instead and re-emits them verbatim with
-     * {@link OStream.writeFixlen} (subtype fp32) — mirroring the visitor `raw`
-     * channel on the push paths (fast.ts / state.ts), which the pull path was
-     * missing (corelib-ts#66).
-     *
-     * The header (subtype fp32, length 4) is validated exactly as in
-     * {@link readFp32}; the returned view aliases the source buffer, valid only
-     * until it is reused, like {@link readBlob}.
-     */
-    readFp32Raw() {
-      this.fixlenHeader(FixlenSubtype.Fp32, 4);
-      return this.take(4);
-    }
-    /** Read a 64-bit float scalar (wire {@link WireType.Fixlen}, subtype fp64). */
-    readFp64() {
-      this.fixlenHeader(FixlenSubtype.Fp64, 8);
-      return this.rawFp64();
-    }
-    /**
-     * Read a UTF-8 string scalar (wire {@link WireType.Fixlen}, subtype string).
-     * Pass the schema `maxlen` (byte length) for a bounded string so an
-     * over-length is rejected as `INVALID` at the header, before the payload is
-     * taken (see {@link fixlenLen}); the wire length is exactly the UTF-8 byte
-     * length, so the check is exact. Omit for an unbounded string.
-     */
-    readString(schemaMaxlen) {
-      const len = this.fixlenLen(FixlenSubtype.String, schemaMaxlen);
-      const bytes = this.take(len);
-      try {
-        return _utf8.decode(bytes);
-      } catch {
-        throw invalidMsgError("invalid UTF-8 in string");
-      }
-    }
-    /**
-     * Read a blob scalar (wire {@link WireType.Fixlen}, subtype blob) as a
-     * zero-copy {@link Uint8Array} view into the source buffer.
-     */
-    readBlob(schemaMaxlen) {
-      const len = this.fixlenLen(FixlenSubtype.Blob, schemaMaxlen);
-      return this.take(len);
-    }
-    /**
-     * Read an unsigned array (wire {@link WireType.ArrayUnsigned}), number-first
-     * per element. Pass the schema `count` for a bounded array so an over-count is
-     * rejected as `INVALID` at the header (see {@link arrayCount}); omit it for an
-     * unbounded array (today's behavior).
-     */
-    readUnsignedArray(schemaCount) {
-      const count = this.arrayCount(schemaCount);
-      const out = new Array(count);
-      for (let i = 0; i < count; i++) {
-        this.readVarint();
-        out[i] = this.unsignedValue();
-      }
-      return out;
-    }
-    /** Read a signed array (wire {@link WireType.ArraySigned}), zig-zag, number-first per element. */
-    readSignedArray(schemaCount) {
-      const count = this.arrayCount(schemaCount);
-      const out = new Array(count);
-      for (let i = 0; i < count; i++) {
-        this.readVarint();
-        out[i] = this.signedValue();
-      }
-      return out;
-    }
-    /**
-     * Read an unsigned 64-bit array into {@link Long}[] — the `bigint`-free path.
-     * Each element keeps the raw lo/hi halves; call {@link Long.toBigInt} to
-     * materialise only the values the caller actually needs.
-     */
-    readUnsignedArrayLong(schemaCount) {
-      const count = this.arrayCount(schemaCount);
-      const out = new Array(count);
-      for (let i = 0; i < count; i++) {
-        this.readVarint();
-        out[i] = new Long(this.lo, this.hi);
-      }
-      return out;
-    }
-    /** Read a signed 64-bit array (zig-zag) into {@link Long}[] — the `bigint`-free path. */
-    readSignedArrayLong(schemaCount) {
-      const count = this.arrayCount(schemaCount);
-      const out = new Array(count);
-      for (let i = 0; i < count; i++) {
-        this.readVarint();
-        const lo = this.lo >>> 0;
-        const hi = this.hi >>> 0;
-        const mask = -(lo & 1) >>> 0;
-        out[i] = new Long((lo >>> 1 | hi << 31) >>> 0 ^ mask, hi >>> 1 >>> 0 ^ mask);
-      }
-      return out;
-    }
-    /** Read an fp32 array (wire {@link WireType.ArrayFixlen}, element subtype fp32). */
-    readFp32Array(schemaCount) {
-      const count = this.arrayFixlenHeader(FixlenSubtype.Fp32, 4, schemaCount);
-      const out = new Array(count);
-      for (let i = 0; i < count; i++) out[i] = this.rawFp32();
-      return out;
-    }
-    /**
-     * Read an fp32 array as its raw little-endian element payload (`count * 4`
-     * bytes), zero-copy — the bit-preserving companion to {@link readFp32Array}.
-     * Widening each element to a JS `number` quiets an fp32 *signaling* NaN just as
-     * on the scalar path (§4.6; see {@link readFp32Raw}), so bit-exact decode reads
-     * the whole payload here and re-emits it with {@link OStream.writeFp32ArrayRaw}
-     * (corelib-ts#66). The header (element subtype fp32, size 4) is validated
-     * exactly as in {@link readFp32Array}; the returned view aliases the source
-     * buffer, like {@link readBlob}.
-     */
-    readFp32ArrayRaw(schemaCount) {
-      const count = this.arrayFixlenHeader(FixlenSubtype.Fp32, 4, schemaCount);
-      return this.take(count * 4);
-    }
-    /** Read an fp64 array (wire {@link WireType.ArrayFixlen}, element subtype fp64). */
-    readFp64Array(schemaCount) {
-      const count = this.arrayFixlenHeader(FixlenSubtype.Fp64, 8, schemaCount);
-      const out = new Array(count);
-      for (let i = 0; i < count; i++) out[i] = this.rawFp64();
-      return out;
-    }
-    /**
-     * Consume the value of the field whose header {@link readHeader} just accepted,
-     * discarding it — for a `default:` branch that keeps the cursor in sync on an
-     * unknown id. Pass {@link wire}. A {@link WireType.SequenceStart} skips the
-     * whole nested sequence.
-     */
-    skip(wire) {
-      if (wire === WireType.SequenceStart) {
-        this.skipSequence();
-        this.depth--;
-        return;
       }
-      this.skipValue(wire);
     }
-    // --- value skipping -----------------------------------------------------
-    skipValue(wire) {
-      switch (wire) {
-        case WireType.Unsigned:
-        case WireType.Signed:
-          this.readVarint();
-          return;
-        case WireType.Fixlen: {
-          this.readVarint();
-          const sub = this.lo & 7;
-          const len = this.upper();
-          if (sub > FixlenSubtype.Blob) throw invalidMsgError(`invalid fixlen subtype ${sub}`);
-          if (sub === FixlenSubtype.Fp32 || sub === FixlenSubtype.Fp64) {
-            if (len !== (sub === FixlenSubtype.Fp32 ? 4 : 8)) {
-              throw invalidMsgError("fixlen float length mismatch");
-            }
-          } else if (len > FIXLEN_MAX) {
-            throw invalidMsgError("fixlen length out of range");
-          }
-          this.take(len);
-          return;
-        }
-        case WireType.ArrayUnsigned:
-        case WireType.ArraySigned: {
-          const count = this.arrayCount();
-          for (let i = 0; i < count; i++) this.readVarint();
-          return;
-        }
-        case WireType.ArrayFixlen: {
-          this.readVarint();
-          const count = this.num();
-          if (count > ARRAY_MAX) throw invalidMsgError("array count out of range");
-          if (count > this.maxArrayCount) {
-            throw limitExceededError(
-              `array count ${count} exceeds maxArrayCount ${this.maxArrayCount}`
-            );
-          }
-          this.readVarint();
-          const sub = this.lo & 7;
-          const size = this.upper();
-          const ok = sub === FixlenSubtype.Fp32 && size === 4 || sub === FixlenSubtype.Fp64 && size === 8;
-          if (!ok) throw invalidMsgError("invalid fixlen array element type");
-          this.take(count * size);
-          return;
-        }
-        default:
-          throw invalidMsgError(`invalid wire type ${wire}`);
-      }
+    try {
+      return _utf8.decode(buf.subarray(start, end));
+    } catch {
+      throw invalidMsgError("invalid UTF-8 in string");
     }
-    skipSequence() {
-      let depth = 1;
-      while (depth > 0) {
-        if (this.p >= this.n) throw incompleteError("truncated message: unbalanced sequence");
-        this.readVarint();
-        const wire = this.lo & 7;
-        if (wire === WireType.SequenceEnd) {
-          depth--;
-          continue;
-        }
-        const id = this.upper();
-        if (id > ID_MAX) throw invalidMsgError(`field id ${id} out of range`);
-        if (wire === WireType.SequenceStart) {
-          if (this.depth + depth - 1 >= MAX_DEPTH) {
-            throw invalidMsgError(`nesting exceeds MAX_DEPTH (${MAX_DEPTH})`);
-          }
-          depth++;
-        } else {
-          this.skipValue(wire);
-        }
-      }
+  }
+
+  // src/decode/acc.ts
+  var PayloadAcc = class {
+    constructor() {
+      this.buf = null;
+      this.len = 0;
     }
-    // --- field helpers ------------------------------------------------------
     /**
-     * Peek the delivered fixlen subtype of the field {@link readHeader} just
-     * accepted, **without advancing the cursor** — the readers / {@link skip}
-     * still re-read and validate the word. Returns one of {@link FixlenSubtype}
-     * (0..3), a reserved value (4..7), or `-1` when the wire is not a fixlen kind
-     * or the subtype word is truncated away.
+     * Contribute one piece — the bytes `src[start..end)` at `offset` of a
+     * `total`-byte payload — and return the **whole** payload once it is complete,
+     * or `null` while bytes are still outstanding.
+     *
+     * `offset === 0` starts a payload — and *resets* the accumulator, so a decode
+     * that was abandoned mid-payload (an `INVALID` field, a declined subtree) leaves
+     * nothing behind to corrupt the next one.
      *
-     * The subtype is the low 3 bits of the fixlen sub-header word, and the low
-     * bits of a LEB128 word live entirely in its **first** byte — so this only
-     * reads one byte, it never decodes a varint.
+     * A late piece with no payload in progress returns `null` rather than writing
+     * anywhere: the accumulator has no buffer to append to, and inventing one would
+     * fabricate a payload out of a fragment.
      */
-    peekFixSub(wire) {
-      if (wire === WireType.Fixlen) {
-        return this.p < this.n ? this.buf[this.p] & 7 : -1;
+    take(total, offset, src, start, end) {
+      if (offset === 0) {
+        this.buf = new Uint8Array(total);
+        this.len = 0;
       }
-      if (wire === WireType.ArrayFixlen) {
-        let p = this.p;
-        while (p < this.n && this.buf[p] >= 128) p++;
-        p++;
-        return p < this.n ? this.buf[p] & 7 : -1;
+      const b = this.buf;
+      if (b === null) return null;
+      let n = end - start;
+      const room = total - this.len;
+      if (n > room) n = room;
+      if (n > 0) {
+        b.set(src.subarray(start, start + n), this.len);
+        this.len += n;
       }
-      return -1;
+      if (this.len < total) return null;
+      this.buf = null;
+      return b;
+    }
+  };
+
+  // src/decode/seq.ts
+  var NO_BYTES = new Uint8Array(0);
+  var UNBOUNDED = -1;
+  function requireReceiverBound(schemaBound, receiver, what, name) {
+    if (schemaBound >= 0) return;
+    if (Number.isFinite(receiver) && receiver >= 0) return;
+    throw argumentError(
+      `${name}: ${what} is ${receiver}, which states no cap \u2014 the schema left this field unbounded, and \xA76.2.1 admits no unset state and no unlimited mode. The number is generated code's to supply.`
+    );
+  }
+  function indexBound(cap, receiverCap) {
+    return cap >= 0 ? cap : receiverCap;
+  }
+  function rejectIndex(id, cap, receiverCap, name) {
+    if (cap >= 0) {
+      throw invalidMsgError(`${name}: array index above schema capacity ${cap}`);
+    }
+    throw limitExceededError(`${name}: array index ${id} exceeds the receiver cap ${receiverCap}`);
+  }
+  var ElementSeq = class {
+    constructor(out, def, cap, name, receiverCap) {
+      this.out = out;
+      this.def = def;
+      this.cap = cap;
+      this.name = name;
+      this.receiverCap = receiverCap;
+      if (cap < 0) requireReceiverBound(cap, receiverCap, "the receiver array-index cap", name);
+      this.bound = indexBound(cap, receiverCap);
     }
     /**
-     * Read and validate an array count word (0..ARRAY_MAX; §4.7/§4.8). When a
-     * `schemaCount` is given, a count above it is a schema-bound violation and is
-     * rejected as `INVALID` — see the check below.
+     * Bound-check `id` and grow `out` to `id + 1`, filling any gap — and the slot
+     * itself — with the element default.
+     *
+     * The check runs **before** the growth, which is the whole of §7.2 item 8's
+     * "after a rejected id the container is not left partially extended": a
+     * rejection leaves `out` exactly as it was, so a lower id delivered afterwards
+     * still lands at its own index.
      */
-    arrayCount(schemaCount) {
-      this.readVarint();
-      const count = this.num();
-      if (count > ARRAY_MAX) throw invalidMsgError("array count out of range");
-      if (schemaCount !== void 0 && count > schemaCount) {
-        throw invalidMsgError("array count above schema capacity");
-      }
-      if (count > this.maxArrayCount) {
-        throw limitExceededError(
-          `array count ${count} exceeds maxArrayCount ${this.maxArrayCount}`
-        );
-      }
-      if (count > this.n - this.p) throw incompleteError("truncated array");
-      return count;
-    }
-    /** Read a scalar fixlen sub-header, asserting subtype and exact byte length (floats). */
-    fixlenHeader(wantSub, wantLen) {
-      this.readVarint();
-      const sub = this.lo & 7;
-      const len = this.upper();
-      if (sub !== wantSub) throw invalidMsgError(`invalid fixlen subtype ${sub}`);
-      if (len !== wantLen) throw invalidMsgError("fixlen float length mismatch");
-    }
-    /**
-     * Read a scalar fixlen sub-header for a string/blob, asserting subtype;
-     * returns the byte length. When a `schemaMaxlen` is given, a length above it
-     * is a schema-bound violation and is rejected as `INVALID` — see below.
-     */
-    fixlenLen(wantSub, schemaMaxlen) {
-      this.readVarint();
-      const sub = this.lo & 7;
-      const len = this.upper();
-      if (sub !== wantSub) throw invalidMsgError(`invalid fixlen subtype ${sub}`);
-      if (len > FIXLEN_MAX) throw invalidMsgError("fixlen length out of range");
-      if (schemaMaxlen !== void 0 && len > schemaMaxlen) {
-        throw invalidMsgError("fixlen length above schema maxlen");
-      }
-      const limit = wantSub === FixlenSubtype.String ? this.maxStringLen : this.maxBlobLen;
-      if (len > limit) {
-        const what = wantSub === FixlenSubtype.String ? "string" : "blob";
-        const name = wantSub === FixlenSubtype.String ? "maxStringLen" : "maxBlobLen";
-        throw limitExceededError(
-          `${what} length ${len} exceeds ${name} ${limit}`
-        );
-      }
-      return len;
+    reserve(id) {
+      if (id >= this.bound) rejectIndex(id, this.cap, this.receiverCap, this.name);
+      while (this.out.length <= id) this.out.push(this.def);
     }
     /**
-     * Read an array fixlen element header (count + element type); returns the
-     * count. When a `schemaCount` is given, a count above it is a schema-bound
-     * violation and is rejected as `INVALID` — see below.
+     * The two index bounds, without growing: the schema `count` as validity
+     * (`INVALID`) or, where the schema left the array open, the receiver cap as
+     * capacity (`LIMIT_EXCEEDED`). Never both — §6.2.1 keeps a cap off a field the
+     * schema already bounds, which is why one `bound` can stand for both.
+     *
+     * Split out from {@link reserve} because a leaf element is bound-checked at its
+     * length word, before its payload has arrived and so before there is anything to
+     * place ({@link StringSeq.begin}).
      */
-    arrayFixlenHeader(wantSub, wantSize, schemaCount) {
-      this.readVarint();
-      const count = this.num();
-      if (count > ARRAY_MAX) throw invalidMsgError("array count out of range");
-      if (schemaCount !== void 0 && count > schemaCount) {
-        throw invalidMsgError("array count above schema capacity");
-      }
-      if (count > this.maxArrayCount) {
-        throw limitExceededError(
-          `array count ${count} exceeds maxArrayCount ${this.maxArrayCount}`
-        );
-      }
-      this.readVarint();
-      const sub = this.lo & 7;
-      const size = this.upper();
-      if (sub !== wantSub || size !== wantSize) {
-        throw invalidMsgError("invalid fixlen array element type");
-      }
-      if (count > (this.n - this.p) / wantSize) {
-        throw incompleteError("truncated fixlen array");
-      }
-      return count;
-    }
-    /** Hand back a zero-copy view of the next `len` bytes, advancing the cursor. */
-    take(len) {
-      const start = this.p;
-      const end = start + len;
-      if (end > this.n) throw incompleteError("truncated fixlen payload");
-      this.p = end;
-      return this.buf.subarray(start, end);
+    checkIndex(id) {
+      if (id >= this.bound) rejectIndex(id, this.cap, this.receiverCap, this.name);
     }
-    rawFp32() {
-      const p = this.p;
-      if (p + 4 > this.n) throw incompleteError("truncated fp32");
-      this.p = p + 4;
-      return this.view.getFloat32(p, true);
+    /**
+     * What {@link reserve} does, then `value` written into the slot. A repeat
+     * replaces (§7.4).
+     *
+     * Written out rather than delegating to {@link reserve}: on the baseline tier a
+     * call is not free, and this is the per-element path. The check still precedes
+     * the growth, which is the property §7.2 item 8 asks for.
+     */
+    place(id, value) {
+      if (id >= this.bound) rejectIndex(id, this.cap, this.receiverCap, this.name);
+      while (this.out.length <= id) this.out.push(this.def);
+      this.out[id] = value;
     }
-    rawFp64() {
-      const p = this.p;
-      if (p + 8 > this.n) throw incompleteError("truncated fp64");
-      this.p = p + 8;
-      return this.view.getFloat64(p, true);
+  };
+  var FramedSeq = class {
+    constructor(out, make, cap, name, receiverCap) {
+      this.out = out;
+      this.make = make;
+      this.cap = cap;
+      this.name = name;
+      this.receiverCap = receiverCap;
+      if (cap < 0) requireReceiverBound(cap, receiverCap, "the receiver array-index cap", name);
+      this.bound = indexBound(cap, receiverCap);
     }
-    // --- varint reading (shared verbatim with ./fast) -----------------------
     /**
-     * The last varint's full value as a `bigint` (64-bit fidelity). Only ever
-     * called from {@link unsignedValue} / {@link signedValue} on the `hi` overflow
-     * path (`this.hi >>> 0 > 0x1fffff`), so `hi` is always non-zero here.
+     * The two index bounds, without growing — see {@link ElementSeq.checkIndex}.
+     *
+     * Split out for the same reason it is there: a caller may have a second bound
+     * to take before anything is allocated. A native matrix row is that case in this
+     * port — its element `count` is rejected at the array header, and §7.2 item 8
+     * wants that rejection to leave the row container exactly as it was.
      */
-    big() {
-      return BigInt(this.hi >>> 0) << 32n | BigInt(this.lo >>> 0);
+    checkIndex(id) {
+      if (id >= this.bound) rejectIndex(id, this.cap, this.receiverCap, this.name);
     }
     /**
-     * The last varint as an unsigned value, number-first: a `number` when it fits
-     * exactly (`≤ 2^53-1`), a `bigint` only beyond that.
+     * Bound-check `id`, **then** grow `out` to `id + 1`, each new slot its own
+     * `make()`.
+     *
+     * The order is §7.2 item 8's "after a rejected id the container is not left
+     * partially extended": a rejection leaves `out` exactly as it was, so a lower id
+     * delivered afterwards still lands at its own index. A slot already present is
+     * left alone — a re-opened `struct` / `union` element merges into the object it
+     * already built, which is what §7.4's last-occurrence-wins means for a scope
+     * whose value *is* the scope.
      */
-    unsignedValue() {
-      const hi = this.hi >>> 0;
-      return hi <= 2097151 ? hi * TWO323 + (this.lo >>> 0) : this.big();
+    reserve(id) {
+      if (id >= this.bound) rejectIndex(id, this.cap, this.receiverCap, this.name);
+      while (this.out.length <= id) this.out.push(this.make());
     }
-    /** The last zig-zag varint as a signed value, number-first. */
-    signedValue() {
-      const hi = this.hi >>> 0;
-      if (hi <= 2097151) {
-        const r = hi * TWO323 + (this.lo >>> 0);
-        return r % 2 === 0 ? r / 2 : -(r + 1) / 2;
-      }
-      return zigzagDecode(this.big());
-    }
-    /** The last varint's value as a JS number — exact for ids/lengths/counts. */
-    num() {
-      return this.hi * TWO323 + (this.lo >>> 0);
+    /**
+     * Bound-check `id`, fill the gap below it, then write `value` into the slot —
+     * what a nested **row** needs, an array wrapper *replacing* whatever an earlier
+     * opening built at that index (§7.4) rather than merging into it.
+     *
+     * The gap fill stops one short of `id` on purpose: the slot is about to be
+     * overwritten, so calling `make()` for it would allocate an element default
+     * nobody ever reads. Assigning at `out.length` extends the array by exactly one,
+     * which is the same array a {@link reserve} would have left.
+     */
+    place(id, value) {
+      if (id >= this.bound) rejectIndex(id, this.cap, this.receiverCap, this.name);
+      while (this.out.length < id) this.out.push(this.make());
+      this.out[id] = value;
     }
-    /** The last varint with its low 3 tag bits stripped (`value >> 3`). */
-    upper() {
-      return (this.hi >>> 0) * (TWO323 / 8) + (this.lo >>> 3);
+  };
+  var StringSeq = class {
+    constructor(out, acc, cap, elemMax, name, receiverCap, receiverElemMax) {
+      this.out = out;
+      this.acc = acc;
+      this.cap = cap;
+      this.elemMax = elemMax;
+      this.name = name;
+      this.receiverCap = receiverCap;
+      this.receiverElemMax = receiverElemMax;
+      requireReceiverBound(elemMax, receiverElemMax, "the receiver element-length cap", name);
+      this.slots = new ElementSeq(out, "", cap, name, receiverCap);
     }
     /**
-     * Decode one LEB128 varint at the cursor into {@link lo} / {@link hi} (each an
-     * unsigned 32-bit half), advancing {@link p}. Throws on truncation or a value
-     * spilling past 64 bits (>10 bytes). Unrolled, number-only — no `bigint`.
+     * The element's fixlen length word ({@link Visitor.fixlenBegin}).
+     *
+     * The bounds are decided by this word, so they are checked here — before any
+     * payload byte — and again in {@link element} below.
+     *
+     * That is not redundancy for its own sake: a message that ends *inside* an
+     * over-long element must still be `INVALID`, and only this event runs early
+     * enough to say so. Without it the verdict would degrade to `INCOMPLETE`, which
+     * §5.2.3 forbids for input already known to be malformed and which §6.4 forbids
+     * a chunk boundary from changing.
+     *
+     * An element of the wrong fixlen subtype is left alone: §7.3 requires it to be
+     * *skipped*, not rejected, and it is skipped by this class simply ignoring it.
      */
-    readVarint() {
-      const buf = this.buf;
-      const n = this.n;
-      let p = this.p;
-      let b;
-      let lo;
-      let hi = 0;
-      if (p >= n) throw incompleteError("truncated varint");
-      b = buf[p++];
-      lo = b & 127;
-      if (b < 128) return this.set(lo, 0, p);
-      if (p >= n) throw incompleteError("truncated varint");
-      b = buf[p++];
-      lo |= (b & 127) << 7;
-      if (b < 128) return this.set(lo, 0, p);
-      if (p >= n) throw incompleteError("truncated varint");
-      b = buf[p++];
-      lo |= (b & 127) << 14;
-      if (b < 128) return this.set(lo, 0, p);
-      if (p >= n) throw incompleteError("truncated varint");
-      b = buf[p++];
-      lo |= (b & 127) << 21;
-      if (b < 128) return this.set(lo, 0, p);
-      if (p >= n) throw incompleteError("truncated varint");
-      b = buf[p++];
-      lo |= (b & 15) << 28;
-      hi = b >> 4 & 7;
-      if (b < 128) return this.set(lo, hi, p);
-      if (p >= n) throw incompleteError("truncated varint");
-      b = buf[p++];
-      hi |= (b & 127) << 3;
-      if (b < 128) return this.set(lo, hi, p);
-      if (p >= n) throw incompleteError("truncated varint");
-      b = buf[p++];
-      hi |= (b & 127) << 10;
-      if (b < 128) return this.set(lo, hi, p);
-      if (p >= n) throw incompleteError("truncated varint");
-      b = buf[p++];
-      hi |= (b & 127) << 17;
-      if (b < 128) return this.set(lo, hi, p);
-      if (p >= n) throw incompleteError("truncated varint");
-      b = buf[p++];
-      hi |= (b & 127) << 24;
-      if (b < 128) return this.set(lo, hi, p);
-      if (p >= n) throw incompleteError("truncated varint");
-      b = buf[p++];
-      if ((b & 127) >> 1 !== 0) throw invalidMsgError("varint overflow");
-      hi |= (b & 127) << 31;
-      if (b < 128) return this.set(lo, hi, p);
-      throw invalidMsgError("varint overflow");
-    }
-    set(lo, hi, p) {
-      this.lo = lo;
-      this.hi = hi;
-      this.p = p;
+    begin(id, subtype, total) {
+      if (subtype !== FixlenSubtype.String) return;
+      this.check(id, total);
+    }
+    /** One payload piece of element `id` ({@link Visitor.string}). */
+    element(id, total, offset, src, start, end) {
+      this.check(id, total);
+      const text = offset === 0 && end - start === total ? decodeUtf8(src, start, end) : decodeStringPiece(this.acc, total, offset, src, start, end);
+      if (text === null) return;
+      this.slots.place(id, text);
+    }
+    /** Every bound for one element. Rejects **before** the destination grows. */
+    check(id, total) {
+      this.slots.checkIndex(id);
+      if (this.elemMax >= 0) {
+        if (total > this.elemMax) {
+          throw invalidMsgError(
+            `${this.name} element: string byte length above schema maxlen ${this.elemMax}`
+          );
+        }
+      } else if (total > this.receiverElemMax) {
+        throw limitExceededError(
+          `${this.name} element: string byte length ${total} exceeds the receiver cap ${this.receiverElemMax}`
+        );
+      }
     }
   };
-
-  // src/backend/native.ts
-  var NATIVE_PACKAGE = "@sofa-buffers/corelib-native";
-  function isNode() {
-    return typeof process !== "undefined" && !!process.versions?.node;
-  }
-  async function loadNativeKernel() {
-    if (!isNode()) return false;
-    try {
-      const { createRequire } = await import('module');
-      const require2 = createRequire((_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('index.global.js', document.baseURI).href));
-      const mod = require2(NATIVE_PACKAGE);
-      const kernel = mod.kernel ?? mod;
-      setKernel(kernel);
-      return true;
-    } catch {
-      return false;
+  var BlobSeq = class {
+    constructor(out, acc, cap, elemMax, name, receiverCap, receiverElemMax) {
+      this.out = out;
+      this.acc = acc;
+      this.cap = cap;
+      this.elemMax = elemMax;
+      this.name = name;
+      this.receiverCap = receiverCap;
+      this.receiverElemMax = receiverElemMax;
+      requireReceiverBound(elemMax, receiverElemMax, "the receiver element-length cap", name);
+      this.slots = new ElementSeq(out, NO_BYTES, cap, name, receiverCap);
+    }
+    /** See {@link StringSeq.begin} — the early bound check, for subtype `blob`. */
+    begin(id, subtype, total) {
+      if (subtype !== FixlenSubtype.Blob) return;
+      this.check(id, total);
+    }
+    /** One payload piece of element `id` ({@link Visitor.blob}). */
+    element(id, total, offset, src, start, end) {
+      this.check(id, total);
+      const payload = this.acc.take(total, offset, src, start, end);
+      if (payload === null) return;
+      this.slots.place(id, payload);
+    }
+    /** Every bound for one element. Rejects **before** the destination grows. */
+    check(id, total) {
+      this.slots.checkIndex(id);
+      if (this.elemMax >= 0) {
+        if (total > this.elemMax) {
+          throw invalidMsgError(
+            `${this.name} element: blob byte length above schema maxlen ${this.elemMax}`
+          );
+        }
+      } else if (total > this.receiverElemMax) {
+        throw limitExceededError(
+          `${this.name} element: blob byte length ${total} exceeds the receiver cap ${this.receiverElemMax}`
+        );
+      }
     }
+  };
+  function decodeStringPiece(acc, total, offset, src, start, end) {
+    const payload = acc.take(total, offset, src, start, end);
+    return payload === null ? null : decodeUtf8(payload);
   }
 
-  // src/backend/wasm.ts
-  async function loadWasmKernel(source, factory, imports = {}) {
-    let instance;
-    if (source instanceof WebAssembly.Module) {
-      instance = await WebAssembly.instantiate(source, imports);
-    } else if (typeof Response !== "undefined" && (source instanceof Response || isThenable(source))) {
-      const result = await WebAssembly.instantiateStreaming(
-        source,
-        imports
-      );
-      instance = result.instance;
-    } else {
-      const result = await WebAssembly.instantiate(source, imports);
-      instance = result.instance;
-    }
-    setKernel(factory(instance.exports));
+  // src/encode/equal.ts
+  function elementsEqual(a, b) {
+    if (a.length !== b.length) return false;
+    for (let i = 0; i < a.length; i++) if (a[i] !== b[i]) return false;
     return true;
   }
-  function isThenable(x) {
-    return typeof x === "object" && x !== null && typeof x.then === "function";
+  function longElementsEqual(a, b) {
+    if (a.length !== b.length) return false;
+    for (let i = 0; i < a.length; i++) {
+      if (a[i].low !== b[i].low || a[i].high !== b[i].high) return false;
+    }
+    return true;
   }
 
   exports.API_VERSION = API_VERSION;
   exports.ARRAY_MAX = ARRAY_MAX;
   exports.ArrayKind = ArrayKind;
-  exports.Cursor = Cursor;
+  exports.BlobSeq = BlobSeq;
   exports.DecodeStatus = DecodeStatus;
+  exports.ElementSeq = ElementSeq;
   exports.FIXLEN_MAX = FIXLEN_MAX;
   exports.FixlenSubtype = FixlenSubtype;
+  exports.FramedSeq = FramedSeq;
   exports.I64_MAX = I64_MAX;
   exports.I64_MIN = I64_MIN;
   exports.ID_MAX = ID_MAX;
   exports.IStream = IStream;
   exports.Long = Long;
   exports.MAX_DEPTH = MAX_DEPTH;
+  exports.MIN_OUTPUT_BUFFER = MIN_OUTPUT_BUFFER;
   exports.OStream = OStream;
+  exports.PayloadAcc = PayloadAcc;
   exports.SofabError = SofabError;
   exports.SofabErrorCode = SofabErrorCode;
+  exports.StringSeq = StringSeq;
   exports.U64_MAX = U64_MAX;
+  exports.UNBOUNDED = UNBOUNDED;
   exports.WireType = WireType;
   exports.decode = decode;
+  exports.decodeUtf8 = decodeUtf8;
+  exports.elementsEqual = elementsEqual;
+  exports.fp32RawBytes = fp32RawBytes;
   exports.getKernel = getKernel;
+  exports.growingOStream = growingOStream;
   exports.jsKernel = jsKernel;
-  exports.loadNativeKernel = loadNativeKernel;
-  exports.loadWasmKernel = loadWasmKernel;
+  exports.longElementsEqual = longElementsEqual;
   exports.setKernel = setKernel;
   exports.sofab = public_exports;